Enable isolated Remote speech and protect reading exports

Attach incoming software speech to reader sessions with lease checks, local output priority and isolated cancellation. Preserve every document fragment source for privacy checks and export reviewed browse current-line reading, spelling and phonetic output.

Verified focused reading and Remote race tests, complete review and external Remote race suites, private relay integration, speech regressions, affected-package vet, reader build and Tentacles make check. Audible speech, physical input/Braille and live interoperability remain unverified.

internal/app/speech_worker.go

@@ -91,6 +91,9 @@ type readAllPart struct {
 // barrier so cancellation cannot overtake newly accepted output.
 type speechWorker struct {
 	remoteOutput   func() *tentacle.RemoteSpeechOutput // Owned under mutex; no runtime/output locks in callback.
+	remoteLifetime context.Context                     // Local output/interruptions retire admitted incoming work.
+	remoteCancel   context.CancelFunc
+	remoteAfter    time.Time // Discard mailbox/assembly work admitted before local output.
 	logger         *slog.Logger
 	speaker        Speaker
 	history        *speechHistory
@@ -203,6 +206,7 @@ func (worker *speechWorker) Enqueue(request speechRequest) {
 		return
 	}
 	request.observation = nil
+	worker.retire_remote_speech_locked()
 	if worker.remoteOutput != nil && exportable_speech(request) && !worker.secure {
 		request.observation = worker.remoteOutput()
 	}
@@ -296,6 +300,7 @@ func (worker *speechWorker) Stop(ctx context.Context) error {
 		return nil
 	}
 	worker.running = false
+	worker.retire_remote_speech_locked()
 	worker.confirmationID = 0
 	if worker.uninterruptibleCancel != nil {
 		worker.uninterruptibleCancel()