Fixes two defects in the full-duplex VoiceChat CLI.
--no-aec captured no audio and hung. The playback graph was attached after engine.start(), an ordering only AUVoiceProcessingIO tolerates because it is a combined I/O unit that pulls audio regardless. With voice processing disabled the input tap never fired, so the session reported frames 0 and never exited, since frame-driven limits like --max-seconds only advance once frames arrive. The playback graph is now attached before starting when AEC is off; the enabled path is unchanged.
Tool calls were unbounded per user turn. A checkpoint that fell into a repetition pattern could issue dozens of successful calls in a row — one observed session searched reminders for "8 PM", "9 PM", and onward past "36 PM" before crashing. Repeat protection was write-only and the function-start gate arms only on failures, so nothing bounded successful reads. Every tool is now limited to five calls per accepted user turn, resetting on fresh acoustic activity, and returns a structured call_budget_exhausted result beyond it.