fix: release reserved L2 agent when AMI redirect fails during escalation

Found during production smoke test: if the AMI Redirect call in
create_escalation() raises (channel gone, AMI hiccup), the agent stays
RESERVED forever with no owning call — orphaned out of the pool until
someone fixes it by hand. Now releases the agent and marks the
escalation failed before re-raising as a 502.

services/asterisk_bridge_service/voice_ai.py

@@ -721,15 +721,25 @@ def create_escalation(call_id: str, body: EscalationRequestIn, actor: dict) -> E
             session.commit()
             raise HTTPException(status_code=409, detail=f"No available {body.target_level} agent right now")
 
-        bridge._ami_action(
-            "Redirect",
-            {
-                "Channel": channel,
-                "Context": bridge._transfer_context(),
-                "Exten": reserved_extension,
-                "Priority": 1,
-            },
-        )
+        try:
+            bridge._ami_action(
+                "Redirect",
+                {
+                    "Channel": channel,
+                    "Context": bridge._transfer_context(),
+                    "Exten": reserved_extension,
+                    "Priority": 1,
+                },
+            )
+        except Exception as exc:
+            try:
+                bridge._release_routing_agent(call_id)
+            except Exception:
+                LOGGER.warning("bridge.escalation_release_agent_failed call_id=%s", call_id)
+            escalation.status = "failed"
+            escalation.completed_at = utc_now_iso()
+            session.commit()
+            raise HTTPException(status_code=502, detail=f"Failed to redirect call to agent: {exc}") from exc
 
         escalation.status = "ringing"
         escalation.assigned_agent_id = reserved_extension