piper: pipe cleanup on early return, write error; misc error hygiene

piper_handler: close stdin/stdout pipes on Start() failure and on
WriteString error instead of leaking fds. Propagate WriteString error.

worker/client: log SetDeadline errors instead of discarding them.

voice/session: pushAudio marshals params inline and returns the marshal
error instead of swallowing it via mustParams (removed).

tool/matcher: log ListTools errors instead of silently returning an
empty allowlist that refuses every act.

config: applyDefaults now sets RouterThreshold and ToolTimeout defaults
so consumers self-contained defaults are belt-and-suspenders.

internal/config/config.go

@@ -223,6 +223,7 @@ const (
 	DefaultRepeatInterval   = 5 * time.Minute
 	DefaultAutotuneInterval = 10 * time.Minute
 	DefaultRouterThreshold  = 0.35
+	DefaultToolTimeout      = 30 * time.Second
 )
 
 // Load reads the JSON config at path and applies defaults. A missing file is
@@ -274,6 +275,15 @@ func (c *Config) applyDefaults() {
 			c.SocketPath = filepath.Join(defaultRuntimeDir(), "mavend.sock")
 		}
 	}
+
+	if c.Voice != nil {
+		if c.Voice.RouterThreshold <= 0 {
+			c.Voice.RouterThreshold = DefaultRouterThreshold
+		}
+		if c.Voice.ToolTimeout <= 0 {
+			c.Voice.ToolTimeout = Duration(DefaultToolTimeout)
+		}
+	}
 }
 
 func (c *Config) validate() error {