feat: built-in engine onboarding, model downloads, Settings providers, and default flip

[quiet-node]

Overview

Delivers the user-facing half of the bundled inference engine and flips the default. A fresh install now downloads a starter model and starts chatting with nothing else to install; Ollama and OpenAI-compatible servers become optional providers. Stacked on the /v1 client (#218). Existing users are unaffected: the loader pins pre-providers configs to Ollama and Ollama wording stays byte-for-byte.

Highlights

• Onboarding: a RAM-aware three-tier starter picker (Fast / Balanced / Smartest) with an "Use my existing Ollama" escape hatch. Curated lineup, all Apache 2.0, pinned to exact repo revisions with a compiled-in sha256 per blob: Fast = Qwen3.5 9B, Balanced = Gemma 4 12B (Google's QAT GGUF), Smartest = gpt-oss 20B. Tuned for 16 GB Macs.
• Non-blocking download: one combined progress bar with live speed/ETA, the download runs in the background so you can finish the intro tour and start typing, an ambient status strip, an in-app completion nudge, and clean resume across relaunches. A native warning guards Cmd+Q and tray quit while a download is in flight.
• Settings Providers panel: three cards. Built-in (installed-model picker, starter and paste-a-HF-repo downloads, per-model size/quant rows with confirm-to-delete, idle-unload control plus a live residency line and "Unload now"). Ollama (URL and model picker, keep-warm). OpenAI-compatible (label, base URL, write-only Keychain API key, vision toggle).
• Friendly model names everywhere: the picker, the titlebar pill, and the per-message attribution chip all show elegant labels (e.g. "Qwen3.5 9B") instead of raw repo:file slugs.
• Provider-aware copy: chat errors, the submit gate, the pickers, search errors, and the context-window helper all branch on the active provider's kind.
• Default flip: DEFAULT_ACTIVE_PROVIDER is now the built-in engine, sequenced last in the stack so nightlies never defaulted to builtin before onboarding could serve it.
• Docs: README, CLAUDE.md, configuration reference, contributing, release, and sandbox docs reframed around the built-in engine.

How it works

Onboarding and Settings share one download hook driven by the backend's typed download events; success fires only after the manifest row and provider model are persisted. The submit gate and pickers read a provider-scoped inventory (manifest for builtin, /api/tags for Ollama, the configured model for openai), so no surface shows another provider's models or copy. The engine runner keeps at most one sidecar process: loads are cancellable, in-flight requests block idle unload, and switching providers unloads the sidecar.

[quiet-node]

Merge gate (do not merge until both are satisfied):

1. Manual integration checklist must pass on real hardware first. This PR carries the default-provider flip (DEFAULT_ACTIVE_PROVIDER -> builtin, commit e26ef17). Once it lands on main, nightly builds from main ship the built-in engine, so the real-machine checks (manual integration checklist items 1-6 and 8-10; item 7 already passed automated) must pass before this merges. feat: bundled engine runner and model library #217 and feat: OpenAI-compatible /v1 client and provider routing #218 were safe to land ahead of this because they keep the default on Ollama; this PR is the gate.

2. Rebase onto main first, for clean history. After feat: OpenAI-compatible /v1 client and provider routing #218 merges, this PR auto-retargets to main; then rebase its own commits with git rebase --onto origin/main f8d5db6 feat/builtin-onboarding-settings-docs and force-push with lease, so it lands as one clean squash commit (same flow used for feat: bundled engine runner and model library #217 and feat: OpenAI-compatible /v1 client and provider routing #218).