piper: pipe cleanup on early return, write error; misc error hygiene

piper_handler: close stdin/stdout pipes on Start() failure and on
WriteString error instead of leaking fds. Propagate WriteString error.

worker/client: log SetDeadline errors instead of discarding them.

voice/session: pushAudio marshals params inline and returns the marshal
error instead of swallowing it via mustParams (removed).

tool/matcher: log ListTools errors instead of silently returning an
empty allowlist that refuses every act.

config: applyDefaults now sets RouterThreshold and ToolTimeout defaults
so consumers self-contained defaults are belt-and-suspenders.

cmd/mavttsd/piper_handler.go

@@ -56,17 +56,26 @@ func (h *piperHandler) Synthesize(ctx context.Context, req worker.SynthesizeReq)
 
 	stdout, err := cmd.StdoutPipe()
 	if err != nil {
+		stdin.Close()
 		return worker.SynthesizeResp{}, fmt.Errorf("piper: stdout pipe: %w", err)
 	}
 
 	if err := cmd.Start(); err != nil {
+		stdin.Close()
+		stdout.Close()
 		return worker.SynthesizeResp{}, fmt.Errorf("piper: start: %w", err)
 	}
 
-	_, _ = io.WriteString(stdin, req.Text)
+	if _, err := io.WriteString(stdin, req.Text); err != nil {
+		stdin.Close()
+		stdout.Close()
+		_ = cmd.Wait()
+		return worker.SynthesizeResp{}, fmt.Errorf("piper: write text: %w", err)
+	}
 	stdin.Close()
 
 	rawPCM, readErr := io.ReadAll(stdout)
+	stdout.Close()
 
 	waitErr := cmd.Wait()
 	if waitErr != nil {