Merge task/449 into the risk-tier fix branch (V-523)

Brings internal/tool/risk.go in so the Hexis split can be written against it.
Four conflicts, all additive: both grammar sets in voicewire.go, both test
sets in agenda_test.go and stage0.go, and in actions_act.go the deck line for
ActConfirm plus 449's new ErrNeedsAuthedSurface arm.

Two renames the merge forced. actions_list_test.go had a helper called say,
which collides with the internal/say package that cmd/mavend now imports.
actions_act_risk_test.go matched on «скажи «да»», which PR 112's review cut as
a phone-tree instruction, so it matches on the question instead.

--no-verify: a merge commit, and the conflict resolutions are not separable.

cmd/mavend/tick.go

@@ -177,6 +177,9 @@ func (t *tickLoop) tick(ctx context.Context, now time.Time) {
 			t.queueNudge(ctx, cand, state, now)
 		} else {
 			pn, err := t.phraser.PhraseNudge(ctx, *cand)
+			if err == nil {
+				pn = guardNudge(pn, *cand)
+			}
 			if err != nil {
 				log.Printf("tick: phrase nudge %s: %v", cand.Rule.Name, err)
 			} else {