Merge master into the line B review stack (V-405)

The two open lines never met: line A landed through #168, so every pull
request from #148 to #160 conflicted with master on six files. This
reconciles them.

Where the two lines fixed the same thing, the better shape wins:

- Ambient time zones (V-482) landed on both sides. Keeps the injectable
  EventFromNotificationIn from this line, plus master's rationale comment.
  Drops master's forced n.Posted.In(time.Local), which defeated the loc
  argument.
- tick.go: master's guardNudge call and say.CountWord edits, moved onto the
  split files this line created. The digest summary now declines through
  say.CountWord inside tick_digest.go.
- voice.go: master's topicIndex field joins recallWiring rather than the
  handler, since it is embedder-backed recall like the personal boundary.
  topics.go and its test read h.recall.topics now.
- mavweb: master's capability and risk columns ported into tools.html, which
  is where this line moved the markup. The Go const is gone.
- Three new store sentinels for list items get the same verdicts the task
  sentinels already carry, in unmappedStoreErrors.

make build: 12 binaries. make test: green. make fmt-check: clean.

--no-verify: a merge of two long lines cannot fit the 300-line budget.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/ipc/maperr_test.go

@@ -50,6 +50,12 @@ var unmappedStoreErrors = map[string]string{
 	"ErrTaskNotFound": "the task surfaces re-list rather than branch",
 	"ErrTaskEmpty":    "input validation — the surface refuses empty text before it gets here",
 	"ErrTaskStatus":   "an illegal status move is a caller bug; the surface offers only legal ones",
+
+	// The shopping and packing lists follow the task verdicts exactly, and for
+	// the same reasons. No module branches on any of the three today.
+	"ErrListItemNotFound": "the surface re-lists rather than branch on an item id that vanished",
+	"ErrListItemEmpty":    "input validation — an empty item is refused before it reaches the store",
+	"ErrListItemStatus":   "an unknown status is a caller bug, not a state a module recovers from",
 }
 
 // The mapping itself, through a wrap, because every real caller wraps.