fix(audio-rooms): round-2 audit — pump self-join (CRITICAL) + 5 other findings

Round 2 audit (3 parallel agents reviewing every change since the
previous follow-up commit) caught one CRITICAL regression and several
HIGH/MED items. Most round-1 fixes verified clean.

CRITICAL fix (audit round-2 MoQ #1):
- Pump exception handlers added in the previous commit call `close()`
  from inside the failing pump's own coroutine. `close()` now does
  `controlPumpJob?.join()` to drain in-flight writes — but the Job we
  try to join is the very Job we're inside, so `join()` suspends
  forever (lambda can't finish until close returns; close can't
  return until lambda finishes). `runCatching` doesn't help — `join()`
  doesn't throw, it suspends. This deadlocks the entire session
  whenever a pump fails.
  Fix: skip the join when the current coroutine IS the job we're
  joining. `currentCoroutineContext()[Job]` identifies the caller; we
  compare and bypass.

HIGH fixes:
- MoQ #2 (regression): concurrent unannounce() + post-OK
  AnnounceError handler could both write UNANNOUNCE on the wire (some
  relays disconnect on UNANNOUNCE for an unknown namespace). Fix:
  `AnnounceHandleImpl.unannounceWritten: Boolean` flag, set under
  stateMutex by whichever writer goes first; the other path skips.
- VM #3 (new): `connect()` overwrote `listener` if invoked from a
  Failed-with-stale-listener state, leaking the previous MoQ session.
  Fix: call `teardown(targetState=Idle, finalCleanup=false)` before
  launching the new attempt when listener or stateObserverJob is
  still alive.
- VM #7 (new): `openSubscription` allocated decoder + player via the
  factories, then attached them to the slot. If the VM scope was
  cancelled between `decoderFactory()` and `slot.attach(...)`, the
  native MediaCodec / AudioTrack leaked because nothing was tracking
  them yet. Fix: nest a try/catch that releases both on any throw
  (including `CancellationException`) before re-throwing.

MED fixes:
- MoQ #7 (new): `capture.start()` could throw before `job` was
  assigned, leaving the broadcaster in a half-started state where
  future `start()` calls would re-pass the guards and double-start
  the mic. Fix: try/catch around capture.start; on throw, set
  `stopped = true` + run capture.stop and propagate.
- MoQ #8 (new): `stopped` was read across threads (setMuted from
  caller, stop from anywhere) without a `@Volatile` barrier.
  Visibility hazard. Fix: `@Volatile private var stopped`.
- Android #12 (new): after the user granted RECORD_AUDIO via the
  Settings deep-link, `permissionDenied` stayed `true` because the
  launcher callback never fired — the warning + Open-settings button
  remained visible until the user tapped Talk again. Fix: derive
  `showDenialWarning` from `permissionDenied AND
  ContextCompat.checkSelfPermission(...) != GRANTED`. Re-checks every
  recomposition (including post-Settings return).

Round-1 fixes verified clean by this audit:
- pending-deferred completeExceptionally on close
- SubscribeDoneStatus codes (UNSUBSCRIBED=0x00, TRACK_ENDED=0x03)
- suspend `stop()` conversions on broadcaster + player
- gate release before NestsSpeaker teardown chain
- unannounce() ordering on thrown wire-write
- SharedFlow PIP signal (rapid double-tap behavior is correct)
- RECEIVER_NOT_EXPORTED gate (constant 4 doesn't collide; round-1
  collision claim was incorrect)
- onUserLeaveHint guards (PIP from lobby, no PIP support)
- foreground service `startForeground`-always-first contract
  (`Result.onFailure` is `inline`, the `return` IS a non-local
  return from `onStartCommand` — verified)
- 4-hour wake-lock cap
- AudioRoomBridge.clear() in AccountViewModel.onCleared

Still deferred:
- VM #6 (round-1 carryover): unsynchronized speakingExpiryJobs map.
  Cross-thread mutation under contention. Needs ConcurrentHashMap or
  Dispatchers.Main.immediate marshalling.
- VM #10 (round-2 new): brief two-QUIC-session overlap during
  rapid disconnect→connect.
- Android #5 (round-2 new): same-room re-entry from MainActivity
  while in PIP doesn't auto-exit PIP.
- MoQ #1, #8 (round-1 carryover): wire-format draft pinning. Still
  blocked on M4 manual interop input.

Verified: spotlessApply clean; :commons:jvmTest, :nestsClient:jvmTest
(80 tests), :amethyst:compilePlayDebugKotlin all green.

commons/src/commonMain/kotlin/com/vitorpamplona/amethyst/commons/viewmodels/AudioRoomViewModel.kt

@@ -164,11 +164,16 @@ class AudioRoomViewModel(
         autoRetryJob = null
         autoRetryAttempts = 0
         retryPending = false
-        // Cancel any previous state observer too — otherwise its delayed
-        // emissions can clobber the fresh Connecting UI we set below
-        // (audit VM #8).
-        stateObserverJob?.cancel()
-        stateObserverJob = null
+        // If a stale listener is still set (e.g. arrived in Failed and the
+        // user is manually retrying before the auto-retry fires, or
+        // entering from a server-Closed-but-not-yet-disconnected state),
+        // tear it down so the new connect doesn't leave the old MoQ
+        // session open and unowned (audit round-2 VM #3). teardown()
+        // also cancels stateObserverJob so its delayed emissions can't
+        // clobber the fresh Connecting UI.
+        if (listener != null || stateObserverJob != null) {
+            teardown(targetState = ConnectionUiState.Idle, finalCleanup = false)
+        }
 
         _uiState.update { it.copy(connection = ConnectionUiState.Connecting(ConnectionUiState.Step.ResolvingRoom)) }
 
@@ -549,19 +554,39 @@ class AudioRoomViewModel(
                 viewModelScope.launch { runCatching { handle.unsubscribe() } }
                 return
             }
+            // Allocate native resources (MediaCodec decoder + AudioTrack
+            // player on Android). Both are heavy and leaky if dropped on
+            // the floor — wrap them in a nested try so any cancellation
+            // or throw between here and slot.attach releases them
+            // (audit round-2 VM #7).
             val decoder = decoderFactory()
-            val player = playerFactory()
-            val isMuted = _uiState.value.isMuted
-            val roomPlayer = AudioRoomPlayer(decoder, player, viewModelScope)
-            // Apply current mute state before play() opens the device so the
-            // first frame respects it.
-            player.setMutedSafe(isMuted)
-            // Tap the object flow to drive the speaking-now indicator before
-            // the decoder consumes it.
-            val instrumented = handle.objects.onEach { onSpeakerActivity(pubkey) }
-            roomPlayer.play(instrumented, onError = { /* swallow per-packet decoder errors */ })
-            slot.attach(handle, roomPlayer, player)
-            publishActiveSpeakers()
+            val player =
+                try {
+                    playerFactory()
+                } catch (t: Throwable) {
+                    runCatching { decoder.release() }
+                    throw t
+                }
+            try {
+                val isMuted = _uiState.value.isMuted
+                val roomPlayer = AudioRoomPlayer(decoder, player, viewModelScope)
+                // Apply current mute state before play() opens the device so the
+                // first frame respects it.
+                player.setMutedSafe(isMuted)
+                // Tap the object flow to drive the speaking-now indicator before
+                // the decoder consumes it.
+                val instrumented = handle.objects.onEach { onSpeakerActivity(pubkey) }
+                roomPlayer.play(instrumented, onError = { /* swallow per-packet decoder errors */ })
+                slot.attach(handle, roomPlayer, player)
+                publishActiveSpeakers()
+            } catch (t: Throwable) {
+                // Either CancellationException (scope cancelled mid-construction)
+                // or an unexpected throw — release the half-built pipeline and
+                // re-throw so the outer catch handles slot rollback.
+                runCatching { player.stop() }
+                runCatching { decoder.release() }
+                throw t
+            }
         } catch (ce: CancellationException) {
             throw ce
         } catch (t: Throwable) {