feat(voice): DAVE E2E + full voice UX (squash of voice/dave-recv)

Squashed branch: voice/dave-recv → master. Closes Pas 12 (DAVE E2E) and lands
voice-mode UX polish + verbal voice control on top of the Pas 1-10 scaffolding
already on master.

## DAVE E2E receive-side decrypt (e4f3177)

Vendored fork: discord-ext-voice-recv 0.5.3a+echo.dave1. Patches the receive
pipeline to handle Discord's mandatory DAVE encryption on voice gateway v=8.
- `_maybe_dave_decrypt`: uses davey.can_passthrough(user_id) as primary gate,
  falls through to dave.decrypt for DAVE-epoch peers, drops on decrypt failure
  without killing the reader thread.
- VAD fix: silero-vad v5+ requires exactly 512 samples; our 100ms window
  (1600 samples) was silently raising ValueError → STT never fired. Now slice
  into 512-sample chunks.
- Whisper: bumped beam_size 1→5 and added RO initial_prompt.
- Tests: 11 DAVE unit tests + 2 callback integration tests + contract test
  with fork-version guard.

## Voice UX polish (d1bc77e)

- Killed the 3s "mă gândesc" filler (always collided with Claude p50 4-7s).
- Barge-in via `ttsq.clear()` at top of `on_segment_done`.
- DTX silence-flush poller (200ms tick) — Discord stops sending RTP packets
  when silent, so the inline silence-check in sink.write() never fired for
  trailing audio; background thread handles it.
- `EchoStreamingAudioSource.read()` non-blocking — old `get_frame(timeout=0.1)`
  wrecked Discord's 20ms cadence and the client interpreted bursts as
  stuttering (Marius heard "4 de minute" instead of full sentence).
- RO time expansion: 23:09 → "douăzeci și trei și nouă minute".
- Supertonic Unicode sanitize centralized in tools/tts.py.
- Whisper local_files_only=True — no HF metadata GET on each startup.
- Diagnostic logging through sink → VAD → Claude stream → TTS chain.

## Voice mode iteration (e589e48)

- `personality/VOICE_MODE.md` — voice-tailored system prompt (short, no
  markdown, no abbreviations, time without seconds, distances in
  "mii"/"milioane"); plumbed via build_system_prompt(voice_mode=True).
- Isolated voice session key `voice:<channel_id>` — voice doesn't share
  context with text adapter on the same channel; auto-applied without
  /clear ceremony. /clear drops both keys.
- Metric units + Romanian thousands (normalize.py): "384.000 km" →
  "trei sute optzeci și patru de mii de kilometri" with feminine-correct
  pluralization and "de" particle for ≥20.
- `/voice setvoice <M1-F5>` slash command with native autocomplete; swaps
  live + persists voice.default_voice to config.json.
- Verbal voice change (src/voice/voice_commands.py + 29 tests) — "schimbă
  vocea pe M5", "voce em cinci", with permissive substring fallback for
  Whisper-mangled forms like "Mâcinci"=M5 and "unul cinci"=M5. Whisper
  initial_prompt now lists voice vocabulary to bias STT toward clean
  outputs.
- Fast barge-in: VAD ≥2 consecutive windows (~200ms) on Marius's user
  while Echo has pending TTS frames → cut him off mid-sentence so user
  doesn't wait the full silence + STT cycle. Acoustic echo bleed-through
  still requires headphones (no AEC).

## Test suite

130 voice + router tests pass (test_voice_recv_dave, test_voice_session_cleanup,
test_voice_adapter_contract, test_voice_normalize, test_voice_commands,
test_router).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/test_voice_adapter_contract.py

@@ -169,3 +169,54 @@ def test_voice_data_has_opus_property():
 
     opus_attr = inspect.getattr_static(VoiceData, "opus", None)
     assert isinstance(opus_attr, property), "VoiceData.opus must be a property"
+
+
+# --- Echo-core DAVE-decrypt fork guards -------------------------------------
+#
+# Two contract tests pinned by the DAVE receive-side decrypt patch.
+# See plan: /home/moltbot/.claude/plans/wiggly-exploring-glade.md
+#
+# These fail fast on either:
+#   1. An upstream voice-recv re-install wiping the fork's version marker
+#      (i.e. our patch is gone), OR
+#   2. A discord.py upgrade renaming the connection-level DAVE attrs the
+#      patch reads (`dave_session`, `dave_protocol_version`).
+
+
+def test_voice_recv_fork_version():
+    """Echo-core fork tag for the DAVE-decrypt patch.
+
+    Lane A bumps `voice_recv.__version__` to `'0.5.3a+echo.dave1'` (PEP 440
+    local segment). If this assertion fails after a vendor reinstall, the
+    fork patch has been lost — re-apply `_maybe_dave_decrypt` + the
+    `callback()` hook before deploying, or live voice will regress to the
+    `opus_decode: corrupted stream` error chain.
+    """
+    from discord.ext import voice_recv
+
+    assert voice_recv.__version__ == "0.5.3a+echo.dave1", (
+        f"voice_recv.__version__ is {voice_recv.__version__!r}; expected "
+        "'0.5.3a+echo.dave1'. The DAVE-decrypt fork patch has been "
+        "overwritten — re-apply before reinstalling the vendored package."
+    )
+
+
+def test_voice_connection_state_has_dave_attrs():
+    """`_maybe_dave_decrypt` reads `dave_session` and `dave_protocol_version`
+    off the discord.py `VoiceConnectionState`. If a future discord.py upgrade
+    renames either attr, fail loudly here rather than in a live voice call
+    (where the symptom is silent packet drops).
+    """
+    from discord import voice_state
+
+    src = inspect.getsource(voice_state.VoiceConnectionState)
+    assert "dave_session" in src, (
+        "discord.voice_state.VoiceConnectionState source no longer mentions "
+        "'dave_session' — discord.py may have renamed the attr. Update "
+        "vendor/discord-ext-voice-recv/.../reader.py::_maybe_dave_decrypt."
+    )
+    assert "dave_protocol_version" in src, (
+        "discord.voice_state.VoiceConnectionState source no longer mentions "
+        "'dave_protocol_version' — discord.py may have renamed the attr. "
+        "Update _maybe_dave_decrypt accordingly."
+    )