feat(voice): voice core — honest layer reach, spoken summary with on-screen card, narration, point-and-ask

- Voice layer manifest (src/voice/layerManifest.js) generates the layer enums,
  aliases and analyst field hints; a test fails when a catalog layer has no entry.
- analyst_query validates fields, operators, units, values and scopes, counts up
  to 250,000 loaded records per layer, reports complete/partial/unanswered, tells
  LAYER_OFF / NOT_READY / FEED_UNAVAILABLE apart from zero, refuses mismatched
  follow-ups and never lets a superseded query replace follow-up memory. Seven
  more layers expose analyst records.
- Tool results carry a code-built say line and a display card; the voice card in
  the mic control shows captions, plan steps and the result
  (src/voice/resultDisplay.js is the one adapter). Slow tools narrate their
  current step out of band; holding Space while the assistant talks cuts it off.
  Turn spans go to the debug log; caption transcription is metered; the log
  omits what was said unless GEV_VOICE_LOG_CONTENT=1.
- Point and ask: the Space-down pointer snapshot resolves "this", "that one" and
  "around here" through 'pointer' targets, and "the second one" through
  referent:n from the last numbered list.
- Prompt states each policy once (instructions + tools 48.5k -> 46.7k chars).
- Voice benchmark harness (scripts/qa-voice-bench.mjs, scripts/voice-bench/)
  shares its phrase table and grading with scripts/qa-voice-routing.mjs.

scripts/voice-bench/keys.mjs

@@ -0,0 +1,35 @@
+/**
+ * Runtime key lookup for the voice benchmark. Keys are read from the
+ * environment, then the macOS Keychain, at call time. They are never written
+ * to results, logs, or files.
+ */
+import { execFileSync } from 'node:child_process';
+
+const KEYCHAIN = {
+  openai: { env: 'OPENAI_API_KEY', service: 'openai-api', account: 'api-key' },
+  gemini: { env: 'GEMINI_API_KEY', service: 'gemini-api', account: 'api-key' },
+};
+
+const cache = new Map();
+
+/** Resolve a provider key from the environment, then the Keychain. */
+export function providerKey(provider) {
+  if (cache.has(provider)) return cache.get(provider);
+  const spec = KEYCHAIN[provider];
+  if (!spec) throw new Error(`unknown key provider: ${provider}`);
+  let value = process.env[spec.env] || '';
+  if (!value && process.platform === 'darwin') {
+    try {
+      value = execFileSync(
+        'security',
+        ['find-generic-password', '-s', spec.service, '-a', spec.account, '-w'],
+        { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] },
+      ).trim();
+    } catch {
+      value = '';
+    }
+  }
+  if (!value) throw new Error(`${spec.env} is not available (env or Keychain)`);
+  cache.set(provider, value);
+  return value;
+}