feat(voiceclaw): Edge voice processing — local VAD, KWS, ASR, TTS with privacy routing

[HenryZ838978]

Summary

VoiceClaw is a new extension that adds edge-side voice processing to EdgeClaw, closing the audio privacy gap that exists when voice data is sent to cloud STT/TTS providers before any privacy checks.

Key Features

Component	Implementation	Privacy
VAD	Silero VAD via sherpa-onnx-node (~0ms)	Always local
KWS	Configurable wake words, sherpa-onnx-node	Always local
ASR	SenseVoice / Whisper / Paraformer (ONNX)	Local for S2/S3, cloud fallback for S1
TTS	VITS / MatchaTTS / edge-tts	Local for S3, cloud fallback for S1/S2

Privacy Guarantee

• S1 (Safe): Cloud ASR/TTS allowed for best quality
• S2 (Sensitive): ASR forced local, transcript desensitized before cloud
• S3 (Private): Both ASR and TTS forced local — raw audio NEVER leaves the device

Integrates with GuardClaw's existing three-tier privacy system via OpenClaw plugin hooks.

What's Included

• extensions/voiceclaw/ — 17 files, ~2400 lines of TypeScript + HTML
• WebSocket audio server for real-time browser microphone streaming
• Session state machine with barge-in detection
• Browser test console with VU meter and event logging
• Unit tests for VAD engine and privacy manager
• Full README with architecture docs and config examples

Technical Choices

• sherpa-onnx-node for all local inference — pure native addon, no Python dependency
• Zero changes to existing EdgeClaw/GuardClaw code
• Follows existing plugin conventions (openclaw.plugin.json, hooks, configSchema)

Test Plan

• pnpm vitest run extensions/voiceclaw/test/
• Load plugin with pnpm openclaw gateway run and verify VoiceClaw banner
• Open browser console at http://localhost:8501/voiceclaw/ and test microphone streaming
• Verify S3 session forces local ASR/TTS (no outbound network calls)
• Verify S1 session allows cloud fallback when configured