Fix live voice leg correlation

[dimavrem22]

Executive Summary

Makes live voice validation select the recipient-owned call leg precisely when paired-call correlation is available, while retaining a strict compatibility lookup for older responses.

Description

• Reads the driver call's optional pairedCallId after completion.
• Queries the recipient identity with that value and rejects missing or ambiguous matches.
• Requires both remote and local speech on the recipient leg across all live voice scenarios.
• Restricts the driver-leg transcript assertion to driver-local speech.
• Keeps the compatibility lookup bounded by baseline IDs, direction, endpoints, timestamps, and uniqueness.
• Names the caller as the explicit SMS recipient and, on a timed corrective turn, makes the hosted agent edit the same persisted action before readback while keeping the strict marker assertion.
• Gives realtime responses a 30-second media-peer window while retaining mandatory two-way transcript proof.
• Places the recipient and run marker first in the spoken request and uses longer speech-safe marker words across TTS/PSTN/STT.
• Releases an inbound A2A session after its tool has durably committed a reply, so caller follow-up is not blocked behind an already-resolved model turn.
• Releases a hosted model turn after its SMS attempt reaches a durable terminal state, allowing strict reconciliation to record the existing success or failure result.
• Retries read-only identity resolution twice for connection resets and transient HTTP failures, while preserving immediate failure for terminal responses.

Reason

A managed call produces separate records for the driver and recipient. Requiring recipient speech on the driver-owned transcript validates the wrong record and can fail despite a successful two-way conversation.

An A2A model can continue generating after its reply tool succeeds. Explicitly ending that host turn preserves the committed protocol state and lets multi-turn caller input proceed.

A hosted model can likewise remain busy after the SMS tool has durably finished. Ending only that completed tool turn allows reconciliation to finish without weakening the exact-recipient, exact-marker, or action assertions.

Gateway startup also depended on a single identity GET. A bounded read-only retry prevents one transient API connection reset from terminating the entire gateway before any voice or vendor path is exercised.

Decisions

• Preserve every existing intent, action, call-status, and speech-mode assertion.
• Fall back only when the installed SDK/API response does not expose paired correlation.
• Reject ambiguous fallback results instead of accepting the newest nearby call.
• Coordinate typed correlation support with inkbox#138.

Testing

• Lint, typecheck, and build pass.
• Full local suite: 825 passed.
• Added unit coverage for paired lookup, compatibility lookup boundaries, ambiguity rejection, and owned-leg transcript assertions.
• Updated workflow YAML parses successfully.