fix(dsh): retain and recover timed Ask User questions

[icodesign]

Timed Ask User questions could disappear from Orbis when DSH's unattended deadline fired: the adapter only retained a foreground waterfall promise and ignored native wait claims and durable continued-question state. The phone now holds the native wait while it owns the question, and reconnecting or restarting the plugin restores continued questions with stable request IDs. Late answers use DSH's native question service and inbox, including PTC sub-calls; queued or claimed replies cannot be submitted twice.

Foreground ownership, question mapping, and durable recovery have separate responsibilities. The mobile subscription documentation is corrected, and a patch changeset is included.

Validation:

• Real Orbis iPhone 17 Pro simulator (iOS 27.0) with DSH 0.2.0-rc.2, the built plugin, real encrypted pairing/transport, and official deterministic LLM replay passed three UI scenarios: question continued before opening the phone chat; question held for 13 seconds while the chat stayed open despite a 2-second unattended timeout; and terminate/relaunch/reopen while pending. Each displayed the question, accepted the UI answer once, cleared native pending state, and completed the assistant response. The timed tool was explicitly enabled in the native standard preset.
• Strict e2e:real passed: native Agent/Bash execution, live/cursor streaming, no-ACK delivery, process restart, cold projection, and full history. Host identity rotation was not exercised because the isolated credential plugin did not persist a file-backed .env. The keyless overlay now disables plugins by their IDs, removing a stale provider-name guard.
• pnpm run check in the public workspace passed (release checks and all core packages).
• pnpm run check:dsh passed: publishable bundle, production/test typechecks, and 186 tests. Six new native-service regression tests cover wait retention, disconnect/restart recovery, late replies, PTC calls, discard/admission, and unsupported continued cancellation; host transport coverage also exercises snapshot and reply RPCs.
• Private workspace package checks, changed-source Oxlint, changed-file Oxfmt, and git diff --check passed. Private root bun run check remains blocked by existing mobile-test type-aware lint errors (unresolved @/ imports and Jest globals).

DSH's current API cannot transfer a still-open question already owned by the desktop, and indefinite questions have no durable continued state. Continued questions support answering/skipping, not cancellation. This repairs the confirmed timed-question gap. Simulator UI is verified, but the reporter's exact TestFlight build and physical phone have not been reproduced, so the issue remains open for that follow-up.

Refs #29