Remind the candidate when they speak while the microphone is muted

Follow-up to #483, whose speaking-while-muted part was deferred to a separate design. The persistent mute indicator from #509 is on main; this issue covers only the reminder and the local detection it needs.

Who is affected and when

A candidate in a live interview mutes the microphone (to cough, or to think aloud privately), returns to the code, and starts answering Jim without unmuting. Jim hears nothing and keeps waiting, so the candidate repeats the answer once they notice. #509 made the muted state visible on the Mic button and beside the interviewer status, but a candidate looking at the editor can still miss both.

Current behavior (main at 750f2d4)

toggleMicrophone in web/interview.js mutes by setting track.enabled = false on every audio track of state.localUserStream (setLocalAudioEnabled, web/interview.js:2570), or by setMicrophoneEnabled(false) when there is no preflight stream. A disabled track delivers silence to every reader, including the turn ring meter (startTurnRing, web/interview.js:3499), so nothing on the page can tell that the candidate is speaking while muted.

Desired outcome

While the microphone is muted, if the candidate speaks for a sustained moment, a text reminder appears next to the Mic button and stays until the microphone is successfully unmuted. Nothing the candidate says while muted reaches Jim, the room, the recording, the transcript or the server.

Present workaround

None besides noticing the indicator.

Proposed scope

1. Detection runs only while muted and only in the interview page (web/interview.js); peer interviews and task mode are out of scope.
2. On mute, clone the microphone track (track.clone(), enabled), feed the clone to an AnalyserNode, and reuse the existing level helpers in web/audio-check.js (peakLevel, sustainedPeak). The clone is never added to state.localUserStream, never published, and never given to the local recorder.
3. The reminder fires once per muted period, after a sustained level above a threshold rather than a single peak, and not while Jim is speaking (agent state speaking), so his voice from the speakers does not trigger it.
4. Once the reminder fires, the clone is stopped and the analyser closed; the text stays visible until unmute succeeds. A failed unmute keeps it.
5. The clone is also stopped on unmute, on interview end, on pagehide, when the track ends (device loss), and is re-cloned from the new track when a microphone switch completes while muted (onSwitched in microphoneSwitch).
6. If cloning or the analyser fails, mute and the #509 indicator behave exactly as today, with no error shown.
7. No new integrity event, data-channel message or report field: the reminder is local UI only.

Approaches compared

• Clone plus level detection (proposed): no new permission prompt, since the device is already granted and, in Chromium, stays open while the track is disabled; no new dependency; false positives from keyboard clicks are limited by requiring a sustained level, but background speech can still trigger it.
• A vendored voice activity detection model: fewer false positives from noise, but web/ has no build step and vendored assets are checksum-pinned, which adds a large asset for a hint.
• Stop the device on mute and detect nothing: strongest privacy, but removes the reminder entirely and changes the meaning of the existing Mic button, so it is out of scope here.

Open questions for the maintainers

• Consent: #483 proposed an opt-in checkbox in the preflight, unchecked by default and valid for one interview. Should the first PR include it, or ship the reminder default-off behind that checkbox only, or default-on with an explanation line? Since the device already stays open while muted, the change is local analysis rather than new capture, but the page should still say so.
• Should the reminder be announced to assistive technology once (role="status"), given it appears without user action?

Acceptance criteria

• Muted plus sustained speech shows the reminder within about one second; a single keyboard click or short noise does not.
• The reminder stays through silence and interviewer state changes, and disappears only after a successful unmute.
• Browser tests (tests/browser/) with a fake meter cover: fire once per muted period, no fire while Jim speaks, cleanup on unmute, end, device loss and failed setup, and re-clone after a microphone switch while muted.
• A test asserts the clone never appears in state.localUserStream, the LiveKit publication or the local recorder's input.
• ./scripts/test.sh passes; the PR includes before and after screenshots of the Mic control.

I read #483, #509, docs/integrity-evidence.md and docs/recording-contract.md, and the mute, microphone switch and mic meter code listed above (I wrote the microphone switch in #426). I plan to implement the scope above once it is agreed.