An unknown whisper model name (e.g. small.zh) used to start a runtime
install and a model download that then 404ed. The whisper manager now
owns the one rule: a name is usable if it is pinned or already
downloaded. ensureModel, the transcribe API and init all check it before
any install or network call, and the --model help lists the pinned
names instead of a hand-kept copy.