audio: actually install the capture path I kept deferring

The audio work was three parts and I shipped two. The transcode-fidelity method
and the pinned 5.1 downmix landed; the null sink -- the only one that answers
"what does the GAME play" -- I deferred to "the next natural rebuild window" and
then rebuilt both images four times without doing it.

pulseaudio-utils is now in both, with tools/audio-capture wrapping it: a null
sink is a real device as far as an application is concerned, so Canary and Godot
open it normally and parec records what they emit.

This unblocks the decoder's Q8. The cue-to-event bindings are currently a name
match against the authors' own identifiers -- a plausible guess, not a
measurement -- and capturing what the game plays on a menu move converts them.

`audio-capture run` reports the peak level and warns when the capture is silent,
because silence is the failure that looks like success: a WAV of exactly the
right duration, full of zeroes, because the application opened a different sink.
A duration check alone passes it, which is how a confident wrong number gets
made.

docker/decoder/Dockerfile

@@ -54,6 +54,13 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
       # expect drives Claude Code's one-time interactive gates for an
       # unattended run — see bin/claude-autonomous.
       expect \
+      # PulseAudio, for capturing audio without a sound card. `module-null-sink`
+      # is a real device as far as any application is concerned, so the emulator
+      # and Godot open it normally and `parec` records what they play. Without
+      # it, "does this actually sound right" is unanswerable in a container --
+      # and the cue-to-event bindings stay a name match rather than a
+      # measurement. See docs/port/AUDIO-VERIFICATION.md.
+      pulseaudio pulseaudio-utils \
     && rm -rf /var/lib/apt/lists/*
 
 # Pin the unversioned tool names to 19 so CMake, and anything that shells out to