fix(desktop): explain missing local catalog

[heomin86]

Summary

• replace the misleading transcription-approval phase with a local-catalog requirement
• report the exact catalog search path and required artifact layout when no source SHA-256 matches
• state explicitly that external files are not auto-imported and that no agents, video mutation, or provider spend occurred
• map the new response fields through the desktop service and cover the contract with a regression test

Verification

• uv run pytest tests/test_desktop_runtime.py::test_unprepared_source_requires_transcription_approval -q — 1 passed
• npm run build in desktop/ — passed
• python3 -m py_compile reelbrain/fanout.py tests/test_desktop_runtime.py — passed
• git diff --check — passed

Existing unrelated test failures

• the full Python suite currently reports 282 passed, 1 skipped, and 1 existing failure in test_renders_centered_blurred_bilingual_short_with_exact_text because RuntimeGuard calls Path.exists() on a long FFmpeg filter string (OSError: File name too long)
• the Rust suite currently reports 12 passed, 2 ignored, and 2 existing fixture-dependent failures in discovers_creator_review_outputs and preflight_is_local_and_detects_audio_video

This PR does not add catalog import or transcription execution; it only makes the existing fail-closed boundary actionable and accurate.

[Q00]

Checked against current main/v0.1.2. This PR should not be merged as-is: it is now conflicting, and its blocked "Local catalog required" flow would regress the current creator-approved local preparation path (transcribe-bilingual / MLX Whisper) that builds the source-digest-bound catalog inside the app workspace. Current main also searches the newer .reelbrain/desktop/sources/ catalog before the historical dogfood layout, so the proposed search-path guidance is incomplete. The relevant current contracts pass in test_unprepared_source_requires_transcription_approval and test_korean_catalog_requires_contextual_translation_approval_then_unblocks_fanout. Closing as superseded by v0.1.2; thanks for identifying the original misleading state.

[Q00]

Correction: I closed this PR prematurely after evaluating it only against the current implementation, without confirming the intended product direction. That was my mistake. I have reopened it. I am re-evaluating the local-catalog guidance and MLX Whisper dependency against the stakeholder requirement before proposing a conflict-safe integration into current main.