fix: remediate vitals, desktop, and repository integrity issues

[ruvnet]

Summary

• replace breathing crest-factor confidence with normalized periodic autocorrelation at the estimated respiratory period
• fix Windows desktop server discovery (.exe + where) and pass logging through RUST_LOG
• align React runtime/types, add Vite ambient types, and correct Tauri frontend hook working directories
• ignore the runtime session secret and pin contributor-harness provenance files to LF across Windows checkouts
• update the desktop dependency lock to clear the current npm advisory set
• harden adjacent vitals evaluation conversions exposed by strict clippy
• with explicit owner authorization, remove the six raw CSI/person-data files identified by ADR-299 from the current tree; Git history is unchanged and still requires separately coordinated incident response

Closes #1610
Closes #1516
Closes #1517
Closes #1518
Closes #1519
Closes #1520

Validation

• cargo test -p wifi-densepose-vitals: 104 unit tests + doc test passed
• cargo clippy -p wifi-densepose-vitals --all-targets --no-default-features -- -D warnings: passed
• cargo test -p wifi-densepose-desktop --lib: 24 passed
• cargo clippy -p wifi-densepose-desktop --all-targets -- -D warnings: passed
• desktop UI: 3 tests passed; production Vite build passed; npm audit --omit=optional: 0 vulnerabilities
• contributor harness: 81 tests + 13 security tests passed; brain/flywheel/manifest verification passed; npm audit clean; package dry-run passed
• cargo test --workspace --no-default-features: passed across the full workspace
• python archive/v1/data/proof/verify.py: VERDICT: PASS, bit-exact hash f8e76f21a0f9852b70b6d9dd5318239f6b20cbcb4cdd995863263cecdc446f7a
• bash scripts/csi-data-policy-check.sh --tracked: passed after current-tree remediation
• secret-oriented diff scan: 0 matches; v2/data/session-secret verified ignored and untracked

Honest local limitations

• cargo tauri build --no-bundle completed its frontend hook but the cold and warmed native Windows release link each exceeded the 10-minute local bound without a compiler diagnostic. The desktop library, strict clippy, production UI build, and full workspace matrix are green.
• cargo fmt --all -- --check reports extensive pre-existing formatting drift throughout current main; git diff --check is clean.
• cargo-audit and cargo-deny are not installed on this workstation; hosted dependency/license gates remain authoritative.