Worker rollout follow-ups: WM 2.11, .tmp resume, service uses worker

[ivan-digital]

Stacked on #22. Three independent improvements to the worker rollout:

1. d1ae47d Bump androidx.work 2.9.1 → 2.11.2

Picks up bug fixes since 2.9.1. The SDK manifest still has the
SystemForegroundService foregroundServiceType override because
2.11's bundled manifest still doesn't declare one — verified by
inspecting the AAR.

2. 7643c4a Preserve .tmp files across worker retries

Two existing deletions in ModelManager were destroying partial
download state we want to keep:

Site	Why it ran	Why it's wrong
Top of ensureModels() — dir.walk().filter{ext==tmp}.forEach{delete}	"Clean up after a previous crash"	Also nukes the in-progress .tmp from the previous worker invocation that returned Result.retry() — every WorkManager retry restarted that file from byte 0.
End of downloadFile() retry loop	"Cleanup before throw"	A transient network failure outliving 5 in-loop retries should still leave resumable bytes for the worker's next try, not throw them away.

Both are now removed. Stale .tmp from an old MODEL_VERSION is still
wiped by the version-mismatch path. Test cleans up tmp file after all retries fail is inverted to assert preservation, using
DISCONNECT_DURING_RESPONSE_BODY to exercise a realistic mid-stream
failure.

Concrete impact: during PR #22's emulator run we observed a worker
retry drop ~2.5 MB of partial parakeet-encoder bytes between
restarts. That doesn't happen anymore.

3. 99838e6 SpeechRecognitionService uses the worker

The service used to call ModelManager.ensureModels() inline from
resolveModelDir(). On a fresh install, the first Gboard mic tap was
synchronously waiting on a 1.2 GB download tied to the binder's
lifecycle.

New flow:

1. Fast path — ModelManager.areModelsReady(ctx, INT8) (new public API; duplicates the per-file validity check from ensureModels() without the download side-effect). If true, return ModelManager.modelDir(ctx) immediately.
2. Slow path — enqueue ModelDownloadWorker and await its terminal state via getWorkInfoByIdFlow().filterNotNull().first { it.state.isFinished }. The worker runs as a foreground service so the download persists past the binder timeout and the user putting the phone in their pocket. The next mic tap takes the fast path.

The protected resolveModelDir() seam stays in place; existing
SpeechRecognitionServiceTest still overrides it.

Test plan

• ./gradlew :sdk:testDebugUnitTest — 26/26 pass
• ./gradlew :sdk:assembleDebug — green
• ./gradlew :app:assembleDebug — green
• Manual: install on emulator, set our service as default voice input (settings put secure voice_recognition_service ...), tap Gboard mic on a fresh install — observe download notification appear, dismiss Gboard, wait, re-tap — should now transcribe without re-downloading.
• Manual: kick off a download in MainActivity, force-quit the app process (adb shell am force-stop ...) mid-download, relaunch — should resume from the last .tmp byte (verify via adb shell run-as ... ls -la files/models), not byte 0.

Notes

• This PR depends on Move model download to a foreground WorkManager worker #22. Retarget to main after Move model download to a foreground WorkManager worker #22 merges.
• areModelsReady is a public-API addition. It belongs in the SDK's surface contract going forward — third-party hosts can use it to gate their own pre-load decisions.