Mint Goal Voice Call

Mint one browser's call, and start answering its delegated goal turns.

The three browser signals are the same ones every unsafe goals route takes — the harness's JSON-body cookie was a relay artifact, and a deployed caller's cookie rides its own request.

The delegated turns then run back through this very surface over HTTP, presenting the caller's session and an allowlisted origin. Self-HTTP rather than an in-process call on purpose: it is the boundary the whole feature was tested against, and it is replica-safe because a goal session lives in Postgres rather than in whichever process answers.