Pluggable local embedder for `index-voice` (keep hash default, optional mini model)

[telivity-otaip]

Why

Voice retrieval uses LocalEmbedder (feature-hash-v1) — fast, no download, privacy-safe — but bag-of-words hashing is weak at rhythm/semantic near-matches. A pluggable local embedder would improve exemplar quality for write without sending text anywhere.

Goal

Keep the hash embedder as the default zero-dep path. Add an optional local model backend (e.g. small sentence-transformers / MLX embedding / ggml) behind a flag:

personality-protect index-voice --embedder hash          # default
personality-protect index-voice --embedder local-mini    # optional extra

Acceptance criteria

• Default behavior unchanged (hash embedder, no new deps)
• Optional embedder behind an extras group (e.g. pip install -e ".[embed]")
• Index metadata records embedder name + dimensions so mismatches error clearly
• Re-index required when switching embedders (documented)
• Side-by-side unit test: Contoso queries retrieve sensible neighbors under both (or at least smoke + contract tests)
• Still fully offline after the one-time weight download
• README documents the tradeoff (quality vs download size)

Pointers

• src/personality_protect/embedder.py
• src/personality_protect/voice_index.py
• tests/test_voice_index.py

Out of scope

• Cloud embedding APIs
• Changing the public Contoso demo to require the heavy embedder

Difficulty

Medium–Hard — architecture is easy; model choice + packaging needs care.