[zhangzhenghao]

Summary

• Add a rust/ Cargo crate exposing safe, owning CPU bindings to the current C++ API via a private exception-contained bridge.
• Support model loading, tokenization, text/audio embeddings, frame and CLaMP3 features, metadata, decoding, resampling and log-mel preprocessing.
• Add documentation, an executable example, generated model fixtures with an independent text oracle, and Linux/macOS/Windows Rust CI.

Verification

• cargo test --all-targets: 4 integration tests passed on Linux.
• cargo test --doc: 2 compile-fail thread-safety tests passed.
• cargo fmt -- --check and cargo clippy --all-targets -- -D warnings passed.
• Executed actual text and audio inference with generated valid GGUF fixtures; verified no clap/ggml/ICU shared runtime dependencies via ldd.
• Independent code review found no blocking issues.

Scope and limitations

• Uses the current C++ API, not the unmerged public C API refactor.
• CPU-only, static PIC native libraries; models deliberately remain !Send/!Sync.
• Repository/path dependency requiring initialized pinned native submodules; publish = false intentionally prevents publishing an unusable standalone archive.
• Rust CI passed on Linux, macOS and Windows at head 64d9841, including real inference and compile-fail thread-safety tests.
• All Python jobs and other native jobs passed. The sole failing native windows-11-arm job crashes in FFmpeg while generating mono.flac (exit 3221225477); identical failure is present on base main 2f557ac (run 40038514228), unrelated to this change.