fix(whatsapp-cloud): review follow-ups for #43921

- nous_subscription: gate the STT managed-default flip on openai-audio
  entitlement and skip when a local backend (faster-whisper or custom
  command) works; new _local_stt_backend_available() helper + tests
- whatsapp_cloud: WHATSAPP_CLOUD_{DM_POLICY,ALLOW_FROM,GROUP_POLICY,
  GROUP_ALLOW_FROM} env overrides so both adapters can run in parallel;
  normalize allowlist entries (JID/punctuation) to bare wa_id
- whatsapp_cloud: wrap per-message event build in try/except (dedup-marked
  wamids would be silently dropped on Meta's batch retry otherwise)
- whatsapp_cloud: validate media_id before URL/filename interpolation,
  delete transient .ogg after voice upload, FIFO-cap interactive-button
  state dicts and per-chat wamid cache
- whatsapp_common: '# **Title**' headers no longer double-wrap asterisks
- setup wizard: read access token / app secret via getpass on TTYs
- docs: new WHATSAPP_CLOUD_* gating env vars

tests/gateway/test_whatsapp_formatting.py

@@ -91,6 +91,13 @@ class TestFormatMessage:
         assert adapter.format_message("## Subtitle") == "*Subtitle*"
         assert adapter.format_message("### Deep") == "*Deep*"
 
+    def test_bold_header_does_not_double_wrap(self):
+        """"# **Title**" must become *Title*, not **Title** (WhatsApp would
+        render the doubled asterisks literally)."""
+        adapter = _make_adapter()
+        assert adapter.format_message("# **Title**") == "*Title*"
+        assert adapter.format_message("## __Strong__") == "*Strong*"
+
     def test_links_converted(self):
         adapter = _make_adapter()
         result = adapter.format_message("[click here](https://example.com)")