3.1 always-on listening: mavwaked with energy VAD + SurfaceVoice

New cmd/mavwaked — always-on voice listening client that:
- Captures PCM from arecord subprocess (16kHz mono int16)
- Runs energy-based VAD in 30ms windows (RMS threshold, adaptive floor)
- Buffers utterances (300ms min speech, 800ms silence end, 10s max)
- Sends complete utterances as PushToTalk with Surface=SurfaceVoice (L0)
- Plays reply audio through aplay subprocess
- No new CGo/onnxruntime deps — pure Go
- 10 VAD tests with -race (speech detect, silence, max duration, reset, adaptive floor)
- Makefile build-waked target + Dockerfile integration + alsa-utils runtime dep

.dockerignore

@@ -13,6 +13,7 @@ certs
 /mavpoll
 /mavcaldav
 /mavenclient
+/mavwaked
 
 # heavy deps we don't need in context. We keep only the prebuilt runtime libs
 # (deps/lib, deps/piper) and the headers the CGO build needs.