fix(voice): keep the run open while a tool holds the floor

[longcw]

Fixes #6658

The bug

Under session.run(), a tool that calls update_agent() inside ctx.foreground() records no handoff and nothing after it.

ctx.foreground() waits for the activity to become idle. The activity becomes idle only after the speech handle of the turn completes, and that same completion ends the RunResult. The run finishes while the tool still waits for the floor. update_agent() then finds a run that is already done, so _watch_handle does nothing.

The fix

• _wait_for_idle_and_hold registers a guard on the active run before it waits for the floor, and releases it on exit. A run cannot complete while a tool waits for the floor or holds it.
• AgentTask suspends that guard with the blocked tasks it already suspends. Without this step, await AgentTask() inside ctx.foreground() deadlocks. The run waits for the guard, the guard waits for the task, and the task waits for a user turn. That turn only arrives after run() returns.
• _watch_handle and the methods next to it accept asyncio.Future. asyncio.Task is a subclass of Future, so every current caller stays valid.

Scope

A tool that returns early with ctx.update() and then works in the background never takes the floor. It gets no guard, so the run keeps its own timing.

A tool that returns early, waits, and then takes the floor much later is still not recorded. Nothing holds the floor in that window, and the later work belongs to a new turn.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 1 additional finding.

[biztex]

I'd misdiagnosed this one on the issue — I reproduced without ctx.foreground() and blamed the pre-1.6.7 on_enter gap. Reaching idle being what completes the run is the part I missed. I've corrected that on #6658 so the reporter isn't left with my workaround.

Independently verified the branch, since I had the context loaded:

• Full pytest --unit: 1708 passed. (One unrelated failure, test_ipc.py::test_proc_pool, is a local native-DLL memory error under full-suite load — passes in isolation.)
• A/B'd the guard by stubbing only its registration in _wait_for_idle_and_hold and leaving everything else identical: 2 failed, 4 passed, failing on exactly the two handoff tests. So they're testing the guard rather than passing incidentally.
• guard.set_result(None) in the finally looked like it could hit InvalidStateError if anything cancelled a watched handle, but nothing in RunResult ever cancels what it watches — the only mutations are add/discard — so it holds.
• Registering before the wait_for_idle() await, with the wait moved inside the try, is what makes the ActivityClosedError path safe; test_guard_released_when_the_floor_never_arrives pins it.

One observation, not a request. In the AgentTask restore path the suspended handles are re-watched into session._global_run_state read after self.__fut, which may be a newer run than the one they were suspended from. That's pre-existing for speech handles and blocked tasks, and for a guard it seems right anyway — the tool still holds the floor, so the new run's turn genuinely isn't finished. Noting it only because guards now ride that path too, and the comment above it explains the unwatch but not the re-watch target.