fix(voice): move active calls between sessions

[johnmatthewtennant]

Summary

When session A owns an active voice conversation, the composer phone in an eligible session B now transfers the call: Berd refreshes authoritative native state, stops and flushes the exact lifecycle in A, then starts B. Calls never overlap, and a failed stop leaves A active instead of starting B.

Ineligible foreign sessions do not show the call button. Cross-window handoffs require the focused renderer to own the target session, and concurrent or stale attempts reconcile to the authoritative native lifecycle.

This also removes a duplicate test import that prevented the frontend check on the current base.

Reviewer-reproducible examples

With Pocket voice installed:

1. Start voice in session A. Open an eligible session B and click the composer phone. Confirm A stops and B becomes active only after A finishes shutting down.
2. Repeat with A and B in separate session windows. Confirm the focused B window can transfer the call and an unfocused or unrelated window cannot.
3. While A is active, open a read-only or otherwise ineligible session B. Confirm its composer does not show the call button.
4. Trigger two eligible replacement attempts close together. Confirm only the authoritative winner remains active and the other surface reconciles without overlapping capture.
5. Force the A stop to fail. Confirm A remains active, B does not start, and B shows the existing localized stop error.

[morgmart]

🤖 Automated code review

REQUEST_CHANGES: The replacement flow does not prove that the focused main window still owns the requested target session before stopping the active call. Supplied GitHub evidence was inspected; all listed check runs for the exact head SHA completed successfully, while the combined commit status remains pending and no Intersect Security Scanning run appears in the supplied evidence.

Deterministic publication result: 1 blocking and 0 non-blocking finding(s) publishable; 0 duplicate(s) suppressed.

[morgmart]

🤖 Automated code review

REQUEST_CHANGES: The current foreground-session acknowledgement has no bounded failure path, so one never-settling IPC request can wedge voice controls for the renderer indefinitely. The prior target-ownership issue is fixed and its resolved thread has a substantive human reply. Supplied GitHub evidence for the exact head SHA was inspected: all listed check runs completed successfully, the combined commit status remains pending, and no Intersect Security Scanning run appears in the supplied evidence.

Deterministic publication result: 1 blocking and 0 non-blocking finding(s) publishable; 0 duplicate(s) suppressed.

[morgmart]

🤖 Automated code review

APPROVE: Fresh review of the full exact three-dot comparison found no publishable blocking or non-blocking issues. The replacement flow now binds authorization to the current foreground session, bounds acknowledgement across supersessions, leaves the active call untouched on failure, releases the operation latch, and has discriminating lifecycle/race coverage. The two prior automated findings are fixed; both threads are resolved and contain substantive human-account replies. Accessibility, localization, navigation/consent guards, async and never-completes behavior, lifecycle races, test honesty, and project/design-system rules were checked. Supplied GitHub evidence for the exact head SHA was inspected: every listed check run completed successfully, the combined commit status remains pending, and no Intersect Security Scanning run appears in the supplied evidence; required checks still govern merge readiness.

Deterministic publication result: 0 blocking and 0 non-blocking finding(s) publishable; 0 duplicate(s) suppressed.

Pending checks: 1 check(s) are not complete.

This approval reflects the completed code review only; merge readiness remains governed by the repository's required checks.