fix(agent): Gate spoken narration on the user setting

[charlesvien]

Problem

#3060 shipped the speak narration tool always-on at the agent side. Every session, local or cloud, gets the "never end a turn silently, every turn MUST call speak" prompt block and the tool itself, regardless of the spoken-notifications setting (default off) or the rollout flag, which only hides the settings UI.

Nothing auto-allows the tool either, so in local attended sessions every speak call throws an MCP permission prompt. The result for anyone on today's master: a permission dialog on nearly every turn, an extra tool call per turn, and the narration text discarded at playback because the setting is off.

Changes

• Plumb the spoken-notifications setting into session start: settings store into sessionService, through agent.start/agent.reconnect into the session _meta as spokenNarration.
• Gate both the speak tool registration and the Spoken Narration prompt block on it. Local sessions with narration off (the default) get neither. Cloud sessions keep emitting unconditionally since the sandbox can't know which clients are listening; playback stays consumer-gated there, and cloud runs use bypassPermissions so they never prompted.
• Auto-allow mcp__posthog-code-tools__speak in canUseTool. It's a fire-and-forget no-op on the agent side and never worth a permission prompt.

Known limitation: toggling narration on mid-session takes effect on the next session, since a running agent process can't be re-prompted or grow a new tool.

How did you test this?

• New and updated unit tests: speak gate on/off/unset, local-tools server registration for the Claude and Codex adapters, canUseTool auto-allow, appended-instructions gating.
• Full @posthog/agent suite (1298 tests), core sessions suite and workspace-server agent suite all pass.
• pnpm typecheck and Biome across the three touched packages.

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[github-actions]

React Doctor found no issues in the changed files. 🎉

_{Reviewed by React Doctor for commit ccc7586.}

[greptile-apps]

_{Reviews (1): Last reviewed commit: "gate spoken narration on the user settin..." | Re-trigger Greptile}

[stamphog]

Gates denied this PR due to a deny-list match on "auth" (appearing in context lines around auth.apiHost/auth.projectId) and T2-never classification. The changes themselves look coherent — threading a spokenNarration boolean through the session stack to gate the speak tool — but with zero reviews and a gate denial, a human sign-off is required before this can proceed.