fix: free local llama-cpp model deterministically to prevent crash on exit

[kurokeita]

Problem

Running ownscribe with the local (llama-cpp) summarization backend crashes on exit, after the summary has already been produced and saved:

Exception ignored in: <function LlamaCppSummarizer.__del__ ...>
AttributeError: 'NoneType' object has no attribute 'suppress'
Exception ignored in: <function Llama.__del__ ...>
TypeError: 'NoneType' object is not callable
ggml-metal-device.m:622: GGML_ASSERT([rsets->data count] == 0) failed
fish: Job 1, 'ownscribe' terminated by signal SIGABRT (Abort)

Root cause

The loaded Llama model was only ever released via __del__. The summarizer object survives until interpreter shutdown, at which point module globals are torn down to None:

• LlamaCppSummarizer.__del__ calls contextlib.suppress(...), but the module-level contextlib is already None → AttributeError.
• llama_cpp's own Llama.__del__ calls free_model, but its C-function pointer is already None → TypeError.

Because free_model never runs, the Metal buffers stay allocated. When the process finally reaches exit() → __cxa_finalize → ggml_metal_device_free, the global device still has live residency sets, so GGML_ASSERT([rsets->data count] == 0) aborts the process with SIGABRT.

__del__ is fundamentally the wrong place for this — at shutdown the model cannot be freed because llama_cpp's C bindings are already gone.

Fix

Free the model deterministically while the interpreter is still alive, instead of relying on __del__:

• Add an idempotent close() plus context-manager protocol (__enter__/__exit__) to the Summarizer base contract (no-op default; backends without native resources inherit it for free).
• Implement close() in LlamaCppSummarizer to free self._llm. It uses a plain try/except rather than contextlib.suppress precisely because it may also run from __del__ at shutdown when contextlib is None.
• Call close() deterministically from every summarization path: run_summarize and _do_transcribe_and_summarize (via try/finally) in pipeline.py, and ask (via with summarizer:) in search.py.
• __del__ remains only as a best-effort backstop.

Testing

• Added 6 unit tests covering close() (frees model, idempotent, no-op without load, error suppression, context manager) and the inherited no-op contract for non-local backends.
• Full suite: 237 passed; ruff check src/ tests/ passes.
• End-to-end: ran ownscribe summarize on a real transcript with the cached phi-4-mini model → exit code 0, none of the Exception ignored / GGML_ASSERT / SIGABRT markers.

[paberr]

Thanks for the PR and writeup. I agree with the analysis!
It's good to merge from my side.