fix(windows): 粘贴模式下也可隐藏键盘列表中的 OpenLess (#1015) (#1017)

* fix(windows): allow hiding OpenLess from keyboard list in paste mode

Extend the keyboard-list visibility toggle and desired-profile logic from
SendInput-only to all non-TSF insertion modes so clipboard paste can hide
OpenLess without blocking TSF when switched back.

Refs: #1015
Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(macos): 把 mlx.metallib 放到 Resources，避免 ad-hoc codesign 失败

Contents/MacOS 里的非 Mach-O 会被当成 nested code；克隆仓没有 Developer ID 时 identity '-' 会直接 bundle 失败。metallib 改为 Contents/Resources，worker 启动时调用 MLX set_metallib_path。

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ci): dispatch 时按版本号跳过 Windows MSI，避免 Beta.N 被 WiX 拒绝

workflow_dispatch 的 ref 不是 tag，OPENLESS_RELEASE_CHANNEL 会落成 stable，但 app 版本仍是 1.3.18-Beta.7。WiX 要求 prerelease 只能是数字，MSI 直接失败。版本带 Beta/Alpha/RC 时与 beta 渠道一样跳过 MSI。

Co-authored-by: Cursor <cursoragent@cursor.com>

* ci(linux): test core without egui host

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Chris233 <h-chris233@outlook.com>

.github/workflows/ci.yml

@@ -3,7 +3,7 @@ name: CI
 # 多平台跨语言质量门禁。release-tauri.yml 是发版流水线（仅打包构建），这里负责
 # 在合并前快速验证两件事：
 #   1. 全部前端/契约测试与 vite bundle 通过（捕获行为、合同及跨 locale 类型 drift）
-#   2. Tauri 后端在 macOS / Windows、移动端在 Android 编译；Linux 只编译共享 core 与 egui host。
+#   2. Tauri 后端在 macOS / Windows、移动端在 Android 编译；Linux 只测试共享 core。
 # 跑 build-mac.sh / windows-package-msvc.ps1 / Tauri bundle 太重；只跑轻量 cargo check + vite build。
 
 on:
@@ -12,12 +12,6 @@ on:
   pull_request:
     branches: [main, beta]
   workflow_dispatch:
-    inputs:
-      upload_linux_validation_artifact:
-        description: Build and upload the Linux egui validation packages (never a release)
-        required: false
-        default: false
-        type: boolean
 
 # 同一 PR 快速重复推送时取消旧运行；workflow_dispatch 用 run_id 隔离。
 concurrency:
@@ -172,7 +166,7 @@ jobs:
             --no-daemon
 
   linux-core-contract:
-    name: Linux core and egui host
+    name: Linux core tests
     runs-on: ubuntu-22.04
     defaults:
       run:
@@ -183,58 +177,13 @@ jobs:
           submodules: false
 
       - uses: dtolnay/rust-toolchain@stable
-        with:
-          components: clippy
 
       - uses: swatinem/rust-cache@v2
         with:
           workspaces: 'openless-all/app -> target'
 
-      - name: Install Linux native dependencies without WebKitGTK
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y \
-            build-essential \
-            libasound2-dev \
-            libdbus-1-dev \
-            libssl-dev \
-            libwayland-dev \
-            libx11-dev \
-            libxkbcommon-dev \
-            ripgrep \
-            pkg-config
-
-      - name: Test and lint shared backend
-        run: |
-          cargo test --locked -p openless-core
-          cargo clippy --locked -p openless-core --all-targets -- -D warnings
-
-      - name: Test Linux host and UI contract
-        run: |
-          cargo test --locked -p openless-linux-egui --all-targets
-          cargo check --locked -p openless-linux-egui --all-targets
-
-      - name: Verify dependency direction, compatibility baseline, and secret surfaces
-        shell: pwsh
-        run: |
-          ./scripts/check-core-deps.ps1
-          ./scripts/check-core-deps.ps1 openless-linux-egui
-          ./scripts/check-command-event-baseline.ps1
-          ./scripts/check-core-secret-surface.ps1
-          ./scripts/check-core-test-isolation.ps1
-          ./scripts/check-core-runtime-seam.ps1
-          ./scripts/check-linux-public-surface.ps1
-
-  linux-egui-validation-artifact:
-    name: Linux egui validation artifact
-    if: github.event_name == 'workflow_dispatch' && inputs.upload_linux_validation_artifact
-    needs: linux-core-contract
-    permissions:
-      contents: write
-    uses: ./.github/workflows/release-linux-egui.yml
-    with:
-      release_tag: ''
-    secrets: inherit
+      - name: Test Core
+        run: cargo test --locked -p openless-core
 
   cross-platform:
     name: ${{ matrix.label }} checks