Release v1.4.3 - Zero SonarQube Issues, and Tag Releases That Publish

The first release to actually publish since v1.4.0. The v1.4.1 and v1.4.2 tags were cut,
but neither produced images or a GitHub Release: the pipeline's SonarQube step analysed
each tag as a branch, which SonarQube Cloud does not allow on this plan, and the failed
gate check skipped both publish jobs. v1.4.3 fixes that and ships everything those two
tags carried, so their notes apply here too:

• v1.4.1 (docs/releases/v1.4.1_github_description.md): SonarQube Cloud in the pipeline,
  a dependency sweep, and coverage for scripts/.
• v1.4.2 (docs/releases/v1.4.2_github_description.md): roughly 660 SonarQube findings
  resolved across the Python modules, scripts, dashboard and tests.

The API contract, the decoding path and the language handling are unchanged.

Highlights

Release Tags Publish Again

A tag run no longer scans the tag. It looks up main's own SonarQube analysis of the
tagged commit, by revision across every page of main's history, and publishes only if
that analysis passed the quality gate. So the gate still guards every release, a tag cut
after main has moved on still finds its own commit's result, and a tag on a commit
main never analysed blocks the release, as it should. A malformed or failed SonarCloud
response is retried rather than crashing the step, and the token travels in a request
header built in Python, never on a curl command line.

No SonarQube Issues, No Duplications

main has no open issues, none marked Accepted or False Positive, and no duplicated
blocks:

• Log injection (pythonsecurity:S5145): request text no longer reaches the log. The
  task-start line records the requested language only as its canonical code from a fixed
  table, or unrecognized; the warning for an unsupported language says it was dropped
  without echoing it. The language lookup itself moved to languages.supported_code,
  which never logs, so an unsupported language also stops warning twice per request.
• Downgrade on redirect (shell:S6506): the CUDA and ROCm installer downloads run
  with redirects disabled (wget --https-only --max-redirect=0); the one GitHub release
  asset, which is served through a redirect, is fetched by a Python snippet that refuses
  any hop leaving HTTPS.
• Unhandled promises (javascript:S9383): the dashboard and analytics pages no longer
  drop a promise. Helpers that handle their own errors are called with void, and the
  history fetch now catches and reports a failure instead of leaving it unhandled.
• list.extend() (python:S9409) in the startup banner.
• Float equality (python:S1244): the audio-matrix CLI compares gain with
  math.isclose.
• Always-true condition (pythonbugs:S2583): the request context's special
  attributes are a table lookup instead of an if-chain that the analysis misread.
• Duplication: the Linux and macOS PowerShell bootstrappers shared 122 duplicated
  lines (key generation, the BatchMode SSH wrapper, the wait-for-host loop). They now
  dot-source one helper, scripts/remote_setup_common.ps1.

Hardware Validation

Real speech, driven over HTTP against the built image, with per-request device evidence:

• Intel NUC (Core Ultra 255H): INTEL-WHISPER on the Intel iGPU, vocal isolation on the
  NPU -- accuracy suite 9/9.
• RTX 3080 laptop with an Intel iGPU: FASTER-WHISPER with vocal isolation on CUDA --
  accuracy suite 9/9.

Results, and what was not run on silicon: docs/validation/v1.4.3/README.md.