packaging: ship espeak, or the STT test probe degrades silently

The test run synthesises a spoken sentence to probe an STT model with real audio
rather than a reachability check. espeak was never in the image, so the probe
fell back to "configured, not verified" — correct behaviour (the gap is ours,
not the model's) and therefore invisible: no error, no failing test. Found by
inspecting a built image.

Added to the full build and to the thin update layer, so it is present whichever
path produced the running image.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0182DhR1eFNPQyGmDrpHbedY

packaging/linux/Dockerfile.oci

@@ -157,6 +157,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
       libsndfile1 \
       libvulkan1 \
       lm-sensors \
+      espeak \
       mesa-vulkan-drivers \
       pciutils \
       openssl \

packaging/linux/Dockerfile.update

@@ -51,7 +51,11 @@ RUN /opt/coderai/python/bin/python3 -m pip install --no-input --no-cache-dir "nv
 # (git is present but the CUDA runtime base ships no ssh). Tiny; keep the overlay
 # still fast. `|| true` keeps offline overlay builds working (HTTPS upgrade still
 # works without it).
-RUN apt-get update && apt-get install -y --no-install-recommends openssh-client \
+# espeak: the model test run synthesises a spoken sentence to probe an STT
+# model with real audio instead of a reachability check. Without it the probe
+# degrades silently to "configured, not verified" — caught by inspecting a built
+# image, not by any test, because the fallback is deliberately not an error.
+RUN apt-get update && apt-get install -y --no-install-recommends openssh-client espeak \
     && rm -rf /var/lib/apt/lists/* || true
 
 # ENTRYPOINT / EXPOSE / VOLUME / ENV / WORKDIR are inherited from the base image.