v0.1b hotfix: prevent Windows model-pack import crash

[drdeepaksatheesh]

Fixes #18.

What changed

• moves model-pack validation/copy work into tauri::async_runtime::spawn_blocking so filesystem hashing/copying cannot block the UI thread;
• contains Rust panics in the import path and returns an explicit error instead of allowing the desktop process to terminate;
• cleans incomplete .importing directories when validation/copy fails;
• preserves the existing SHA-256/path-traversal trust boundary;
• adds Rust regression tests for safe model-pack paths;
• CI now runs cargo test --lib before packaging;
• aligns Tauri JS/Rust package lines after CI exposed an unpinned dependency-resolution mismatch;
• alpha.5 also hardens startup/post-import discovery: discovery now runs off the UI thread, catches panics, skips incomplete .importing/disabled version directories, and tolerates unreadable entries instead of terminating the app;
• bumps the current hotfix build to 0.1.0-alpha.5.

Windows reproduction evidence

Alpha.4 import appeared to complete, then the application repeatedly crashed. Renaming the app-data models directory to models-disabled made the application launch and remain stable. This isolates the remaining failure to installed-pack discovery rather than the PDF reader, sidecars, or general shell.

CI evidence

GitHub Actions run 35044524005 for alpha.5:

• frontend tests/build/audit: PASS;
• Rust unit tests: PASS;
• Windows Tauri/NSIS build: PASS;
• installer validation + SHA-256 manifest: PASS;
• artifact upload: PASS.

Validated alpha.5 installer:

• Open Document Understanding_0.1.0-alpha.5_x64-setup.exe
• SHA-256 767868411b45021f2455c61e77419d2918acd8018d621bb6797c4d01a796e632

The PR remains open only for the targeted Windows smoke test: install alpha.5, rename models-disabled back to models, launch the app, and confirm the existing fixture is discovered without a crash. If discovery fails, alpha.5 should surface an error rather than terminate.