refactor(huddle): switch local TTS to Pocket TTS (Kyutai/sherpa-onnx)

[tlongwell-block]

What

Swaps the local huddle TTS from Kokoro (loaded via ort) to Pocket TTS (Kyutai Labs, Apache-2.0) running through the same sherpa-onnx static library that already powers STT. This is a Kokoro→Pocket model swap, but the user-visible win is the removal of the ort direct dependency tree and its runtime libonnxruntime.dylib — the dylib that was the source of the gatekeeper-quarantine "damaged app" failures on older Macs.

Why this is the headline change

Before:

• ort (Rust crate) dlopen'd a prebuilt onnxruntime dylib at runtime.
• sherpa-onnx-sys linked a second onnxruntime statically into the same binary.
• Two onnxruntime copies in-process, no shared env/allocator/thread-pool, ~30 MB of duplicate runtime.
• libonnxruntime.dylib shipped in Sprout.app/Contents/Frameworks/, ad-hoc-signed by the Rust crate's build script, periodically quarantined by Gatekeeper on first launch.

After:

• One statically-linked onnxruntime (the one sherpa was already using).
• Zero *.dylib in the macOS bundle. Verified with find … '*onnx*' -o '*.dylib' and otool -L Contents/MacOS/Sprout on a full unsigned tauri build.
• cargo tree -i ort / -i ort-sys / -i ndarray → "not found."

Tradeoff: CoreML

We lose access to CoreML acceleration. The upstream k2-fsa static archive doesn't ship a CoreML-enabled onnxruntime, and building one ourselves would re-introduce the same dylib distribution + signing pain we're deleting. Bench on M1 8GB:

Metric	Pocket TTS (CPU)
Engine load (one-time)	~289 ms
Warm synthesis (75-char sentence)	~680 ms
Throughput	~5× realtime

(No measured Kokoro baseline to compare against — the previous "2.6× realtime / 200ms TTFA" numbers in the codebase turned out to be an unverified doc-comment about batching strategy, not a benchmark. If anyone needs an apples-to-apples comparison, we can re-run Kokoro on the same rig as a follow-up.)

What's in the diff

• huddle/pocket.rs (new, 238 lines) — sherpa-onnx Pocket TTS wrapper, mirrors huddle/stt.rs config pattern.
• huddle/kokoro.rs deleted (973 lines).
• huddle/tts.rs — engine import swap, voice path becomes .wav, new normalize_for_playback(samples) function (per-sentence peak normalization to −6 dBFS with MAX_GAIN=8.0 to cap over-amplification of near-silent buffers; +5 unit tests).
• huddle/models.rs — Kokoro file list → Pocket bundle (5 ONNX + 2 JSON + voice WAV + LICENSE + MODEL_LICENSE.txt). Readiness fails-closed without the attribution sidecar (+1 test).
• Cargo.toml / Cargo.lock — drops ort + ndarray direct deps; lockfile shrinks 334 lines.
• API rename kokoro → tts across mod.rs, pipeline.rs, lib.rs, and the frontend HuddleBar.tsx. Status surface is now engine-agnostic.
• desktop/scripts/check-file-sizes.mjs — net −1 override entry: removes the now-deleted kokoro.rs budget (980); bumps models.rs (900→930) and tts.rs (1030→1130) to fit the normalize fn + new tests.

Net diff: 12 files, +700 / −1436 lines (most of it the kokoro.rs deletion).

Voice change

Bundled reference is now Kyutai's American-male sample (the previous voice was Kokoro's af_heart, American-female). Per-sentence peak normalization brings playback level to −6 dBFS regardless of the bundled-voice peak, with MAX_GAIN=8.0 keeping near-silent buffers from being amplified to noise.

Verification

$ cargo fmt --check                                        ✅
$ cargo test --lib                                          ✅ 305/305 (was 299; +5 normalize, +1 sidecar)
$ cargo test --lib huddle::tts                              ✅ 24/24
$ cargo build --release --lib                               ✅ 23s clean
$ just desktop-tauri-check                                  ✅
$ pnpm build                                                ✅ (frontend)
$ just desktop-release-build aarch64-apple-darwin           ✅ (signed-ready Sprout.app + DMG)
$ cargo tree -i ort         / -i ort-sys / -i ndarray       ✅ all "not found"
$ find Sprout.app -iname '*onnx*' -o -iname '*ort*' -o -name '*.dylib'   ✅ empty
$ otool -L Sprout.app/Contents/MacOS/Sprout | rg -i onnx|ort  ✅ empty

How to validate locally

1. Build + launch the desktop app.
2. Join a huddle. Watch stderr for TTS warmup completed in {N}ms — expect ≤1500 ms on Apple Silicon with 8 GB+. >1500 ms suggests memory pressure / paging from concurrent STT+TTS init.
3. Confirm no OfflineRecognizer::create returned None in stderr (STT load path).
4. Activity Monitor: sprout RSS should settle <800 MB after huddle join. If >800 MB, the spawn order can be serialized (load TTS engine before spawning STT worker) — a one-line follow-up, not a re-architect.

Follow-ups (deliberately out of scope)

• A measured Kokoro-vs-Pocket bench on the same rig, if anyone wants the comparison defended.
• An Intel-Mac bench to confirm no regression on x86_64 (the x64 sherpa static archive is supported by sherpa-onnx-sys 1.12.38; should just work).
• Investigate sherpa-onnx's per-call resampler creation (Creating a resampler: in=16000 out=24000 fires every synth call) — upstream caching opportunity.

Co-investigation

This change was co-investigated with the Goosetown bot crew (Max, Mari, Perci, Quinn, Sami) in the original research/coordination thread. Reviews covered: bundle/signing verification end-to-end (Mari, Sami, Perci), TTS pipeline structural review (Perci, Max), per-sentence loudness normalization design (Quinn, Max), sidecar readiness test (Mari, Max), and PR-claim accuracy (Quinn).