3.1 always-on listening: mavwaked with energy VAD + SurfaceVoice

New cmd/mavwaked — always-on voice listening client that:
- Captures PCM from arecord subprocess (16kHz mono int16)
- Runs energy-based VAD in 30ms windows (RMS threshold, adaptive floor)
- Buffers utterances (300ms min speech, 800ms silence end, 10s max)
- Sends complete utterances as PushToTalk with Surface=SurfaceVoice (L0)
- Plays reply audio through aplay subprocess
- No new CGo/onnxruntime deps — pure Go
- 10 VAD tests with -race (speech detect, silence, max duration, reset, adaptive floor)
- Makefile build-waked target + Dockerfile integration + alsa-utils runtime dep

Dockerfile

@@ -44,14 +44,15 @@ RUN go build -o /out/mavend    ./cmd/mavend    && \
     go build -o /out/mavttsd   ./cmd/mavttsd   && \
     go build -o /out/mavweb    ./cmd/mavweb    && \
     go build -o /out/mavpoll   ./cmd/mavpoll   && \
-    go build -o /out/mavcaldav ./cmd/mavcaldav
+    go build -o /out/mavcaldav ./cmd/mavcaldav && \
+    go build -o /out/mavwaked  ./cmd/mavwaked
 
 FROM debian:trixie-slim AS runtime
 # tzdata so the TZ env (set in compose) resolves — otherwise Go can't load the
 # zone and time.Now() stays UTC, and mavend answers clock/date queries and
 # evaluates quiet-hours in UTC.
 RUN apt-get update && apt-get install -y --no-install-recommends \
-      ca-certificates libvulkan1 mesa-vulkan-drivers libgomp1 tzdata && \
+      ca-certificates libvulkan1 mesa-vulkan-drivers libgomp1 tzdata alsa-utils && \
     rm -rf /var/lib/apt/lists/*
 
 # runtime native libs: whisper/ggml (incl. vulkan) are real files in deps/lib.