feat(voice): on-device voice tier — Gemma 4, Moonshine and Kokoro in the browser

scripts/check-import-directions.mjs

@@ -24,6 +24,10 @@ const renderer = (file) =>
   /^src\/layers\/[^/]+\/(?:index|rendering|snapshotRenderer|overlay|presentation|cards|controls)\.js$/.test(
     file,
   );
+// The runtime phonemizer loader imports a downloaded file only after its
+// SHA-256 matches the pinned value; no other module may import a computed URL.
+const verifiedRuntimeImport = (file) =>
+  file === 'src/voice/local/workers/phonemizerRuntime.js';
 // Two compatibility composition entries intentionally select standalone defaults.
 const compatibilityEdge = (from, to) =>
   (from === 'server/providers/local.js' &&
@@ -84,7 +88,9 @@ export function checkImportDirections(root) {
     }
     let analysis;
     try {
-      analysis = analyzeModule(readFileSync(resolved, 'utf8'));
+      analysis = analyzeModule(readFileSync(resolved, 'utf8'), {
+        allowComputedImport: verifiedRuntimeImport(file),
+      });
     } catch (error) {
       report(file, error.message);
       return null;