Fix automated post-release findings

[BrettKinny]

Summary

• deterministically route explicit PiVoice remember, recall, and think-hard intents with honest failure postconditions
• preserve server-pushed speech across concurrent chat sentence-ID changes using explicit TTS arbitration
• persist the last observed firmware mutex across dotty-behaviour restarts
• correct the non-existent on-device Advanced Options setup instructions and guard them in tests

Root causes

Post-release live probes showed the 4B model still ignored tool-routing prompts, behaviour state was lost on container restart, and the public firmware instructions described an OTA editor that does not exist. A deterministic harness also reproduced the server-push sentence-ID race.

Validation

• 50 main/PiVoice/Xiaozhi/docs focused tests passed
• 14 behaviour persistence tests passed
• Ruff passed for all changed Python files
• git diff --check passed

Live deployment verification will be added after this draft is built and exercised on Dotty 1.3.3.

This PR was prepared with AI-assisted implementation and review.

[BrettKinny]

This was generated by AI during automated verification.

CI is fully green. Tower deployment evidence:

• dotty-behaviour rebuilt healthy with matching hashes. A production-shaped state_changed: security event survived a real container restart and was then restored to idle, validating Bridge ↔ firmware state divergence after bridge restart #21 persistence.
• Xiaozhi rebuilt from this PR; the fail-fast build patch reported 5 TTS consumers patched, and the container restarted healthy.
• The deployed deterministic Pi tool subprocess executed memory_lookup inside dotty-pi and returned the expected (no memories found) sentinel.
• Full device-route acceptance for say bypass races chat turns under continuous ASR — sentence_id arbitration #104/UAT UT1/UT2/UT6: pi voice tools never invoked — qwen3.5:4b answers directly under the production prompt #165 is pending: Dotty currently opens the WebSocket but disconnects before hello/MCP (LAN ping latency observed at 182–1024 ms). No half-open injection was treated as evidence.

Automated capture: uat-sessions/2026-07-12-auto/ locally.