Add bread-utils and bread-onnx: shared crates for ecosystem-wide duplication

bread-utils extracts genuinely duplicated logic found across breadbox,
breadclip, breadmon, breadcrumbs, bos-settings, and breadhelp:

- hypr: Hyprland socket1 request/response client (breadbox's
  get_active_workspace + breadclip's position.rs hyprctl_json were
  near-identical), socket2 path resolution (breadmon), and a
  version-tolerant `fullscreen` field parser (Hyprland has shipped both
  bool and int representations across versions).
- singleton: correct flock-based single-instance toggle, replacing the
  TOCTOU-prone read-pid/check-proc/kill/write-pid pattern duplicated
  verbatim between breadbox and breadclip (breadclip's own comment says
  "matches breadbox pattern").
- proc: breadcrumbs' timeout-guarded subprocess runner, promoted verbatim
  as the one implementation in the ecosystem that already got this right.
- atomic + xdg: atomic (temp-then-rename) file writes with an optional
  .bak-before-overwrite variant, and XDG path helpers that never fall back
  to a literal "~/..." string (the exact breadclip-core and
  breadpad-shared bug: PathBuf never expands `~`).
- tomlcfg (feature "toml"): the load_doc/save_doc TOML-editing discipline
  bos-settings and breadhelp both implemented byte-for-byte identically in
  the same fix pass that introduced it.
- gtk_popup (feature "gtk"): layer-shell overlay window setup, visible-row
  navigation, and click-outside-close, deduplicated from breadbox and
  breadclip (~150 duplicated lines, per both apps' own "same as breadbox"
  comments).

bread-onnx extracts the embedding pipeline (tokenize -> tensor build ->
mean-pool -> L2-normalize) duplicated near-verbatim between breadarr and
breadsearch, a shared execution-provider session builder with loud EP-
registration logging, and a model download+integrity helper. Defaults AMD
iGPU acceleration to ort::ep::MIGraphX (not ROCm) per this machine's own
breadsearch-gpu-backends lesson: ROCMExecutionProvider silently no-ops to
CPU on distro ROCm onnxruntime builds compiled with --use_migraphx.

Both crates build and pass their own test suites standalone. Consumer
migrations follow in subsequent commits.

bread-onnx/Cargo.toml

@@ -0,0 +1,34 @@
+[package]
+name = "bread-onnx"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+authors.workspace = true
+description = "Shared ONNX Runtime plumbing for the bread ecosystem: session building, execution-provider fallback with loud diagnostics, embedding-pipeline tensor math, and verified model downloads"
+repository = "https://github.com/Breadway/bread-ecosystem"
+keywords = ["onnx", "onnxruntime", "ml", "embeddings"]
+
+[dependencies]
+bread-utils = { path = "../bread-utils" }
+# Left at default-features = false, with no api-XX/download-binaries/
+# load-dynamic/tls-native features of our own: those choices (how each app
+# obtains/links its onnxruntime .so, and which ONNX Runtime C API version to
+# bind) are consumer-build-environment decisions that stay in each app's own
+# Cargo.toml (breadarr, breadmill, and breadpad already each pin different
+# ones). Cargo's feature unification means this crate's minimal declaration
+# just rides along with whatever the consuming app already selected.
+ort = { version = "2.0.0-rc.12", default-features = false, features = ["std", "tracing"] }
+# Default features left on (unlike `ort` above) — breadarr and breadmill
+# both already build against plain default-featured tokenizers; only
+# breadpad customizes this (http, fancy-regex), and Cargo's feature
+# unification only ever adds features on top of this minimal baseline, so
+# breadpad's own selection still applies in its own build.
+tokenizers = "0.23"
+tracing = { workspace = true }
+ureq = { workspace = true }
+sha2 = { workspace = true }
+hex = { workspace = true }
+anyhow = { workspace = true }
+
+[dev-dependencies]
+tempfile = "3"