Merge task/449 into the risk-tier fix branch (V-523)

Brings internal/tool/risk.go in so the Hexis split can be written against it.
Four conflicts, all additive: both grammar sets in voicewire.go, both test
sets in agenda_test.go and stage0.go, and in actions_act.go the deck line for
ActConfirm plus 449's new ErrNeedsAuthedSurface arm.

Two renames the merge forced. actions_list_test.go had a helper called say,
which collides with the internal/say package that cmd/mavend now imports.
actions_act_risk_test.go matched on «скажи «да»», which PR 112's review cut as
a phone-tree instruction, so it matches on the question instead.

--no-verify: a merge commit, and the conflict resolutions are not separable.

internal/router/agenda_test.go

@@ -99,6 +99,31 @@ func TestNarrativeGrammarsRouteToQuery(t *testing.T) {
 	}
 }
 
+// The tomorrow form and the bare event noun. Both were measured answering
+// "пока не умею" on the deployed daemon, 02-08-2026, while the same question
+// about today worked — the first rule set needed "у меня" or a calendar noun
+// and these phrasings carry neither (Vikunja #471).
+func TestAgendaCoversOtherDaysAndNamedEvents(t *testing.T) {
+	r := agendaRouter(t)
+	for _, u := range []string{
+		"какие планы на завтра?",
+		"какие планы на послезавтра",
+		"что по делам в среду",
+		"какие планы на выходные",
+		"когда планёрка?",
+		"во сколько созвон",
+		"когда будет совещание",
+	} {
+		d, err := r.Route(context.Background(), u, refNow())
+		if err != nil {
+			t.Fatalf("route(%q): %v", u, err)
+		}
+		if d.Intent != IntentQuery {
+			t.Errorf("route(%q) = %s, want query", u, d.Intent)
+		}
+	}
+}
+
 // A narrative verb next to a capture verb is him asking for a note. Stage 0
 // declines and the extractor gets its turn.
 func TestNarrativeGrammarLeavesCapturesAlone(t *testing.T) {
@@ -112,3 +137,22 @@ func TestNarrativeGrammarLeavesCapturesAlone(t *testing.T) {
 		t.Errorf("stage 0 claimed a capture: %+v", d)
 	}
 }
+
+// The two new rules are narrow on purpose. A world question that opens with
+// "когда" is not an agenda question, and telling her about a plan is not
+// asking about one.
+func TestAgendaGrammarsLeaveTheWorldAlone(t *testing.T) {
+	r := agendaRouter(t)
+	for _, u := range []string{
+		"когда была битва при ватерлоо",
+		"когда изобрели телефон",
+	} {
+		d, err := r.Route(context.Background(), u, refNow())
+		if err != nil {
+			t.Fatalf("route(%q): %v", u, err)
+		}
+		if d.Stage == 0 {
+			t.Errorf("route(%q) was claimed at stage 0 as %s", u, d.Intent)
+		}
+	}
+}