Stabilize Gemini Live real-mic flow and add strict release gate

[OpenlabSimon]

Summary

This PR stabilizes the desktop Chrome Gemini Live real-microphone path and turns it into a repeatable release gate.

Main changes:

• serialize Gemini Live realtime input sends so activityEnd cannot race ahead of the last audio chunk
• add explicit diagnostics for last_audio_chunk_sent and activity_end_sent
• add local non-production AUTH_SECRET fallback to remove noisy /api/auth/session 500s during local Live diagnostics
• add repeatable real-mic regression commands:
  • npm run smoke:live:real
  • npm run smoke:live:real:strict
• add self-hosted macOS GitHub Actions workflow for the strict real-mic gate
• add runner setup docs, PR template guidance, and PR label helpers for real-mic-gate

Why

We needed a reliable way to answer two questions:

1. Is the real-mic Live path stable enough on desktop Chrome?
2. Can we block risky Live changes from shipping without rerunning ad hoc manual checks every time?

This PR addresses both by improving ordering correctness in the client and by formalizing the real-mic gate as a repeatable workflow.

Validation

Ran:

• npm test -- __tests__/unit/lib/auth-secret.test.ts __tests__/unit/lib/live-client.test.ts __tests__/unit/components/gemini-live-voice-panel.test.ts
• node --check scripts/run-real-mic-live-regression.js
• sh -n scripts/real-mic-gate-label.sh
• RUNS=1 npm run smoke:live:real:strict

Latest real-mic strict result:

• completedRounds=1
• fallbackActive=false
• trackSampleRate=48000
• allOrdered=true
• allAligned=true

Operational Notes

• The GitHub Actions gate is restricted to:
  • manual workflow_dispatch
  • PRs labeled real-mic-gate
• The workflow is intended only for a self-hosted macOS runner with:
  • headed Chrome
  • real microphone permission
  • speaker playback
• Hosted runners are not a valid target for this gate.

Follow-Up

• Use the real-mic-gate label only for PRs that can affect the desktop Chrome Gemini Live real-mic path