Persist native human questions through timeout and explicit recovery

[Guffawaffle]

Worker questions now remain durable when a display is skipped, expires or loses its connection. Explicit recovery reopens the same pending question with a fresh presentation and challenge; late replies cannot answer a replacement display. The portable service persists the hold before presentation and keeps answer-dependent work held.

Adds a source-only MCP presentation adapter with an injected protected admission port, cancellation-aware store commits, single-send answer delivery, and bounded reconciliation observations. Native cleanup and exact matching output are recorded as evidence while the hold remains active. A separate nonsigning diagnostic probe exercises desktop presentation and recovery.

Validation: affected memory/SQLite, transport, presentation, interruption and store tests pass. Exact-candidate lint, build, package-boundary and install-policy gates pass. Full branch independent review passed (370/370 affected tests); PR CI must pass before merge. Historical desktop recovery and installed-Codex output observations retain their original artifact/runtime scope.

This is a source-only foundation. Production human admission, protected source provenance/retention, worker consumption and action containment remain separate qualification work. No default controller, public answer route or production signer is enabled; passkey/OIDC remain optional host choices.

Independent review: PASS by /root/native_probe_ux_review, full 23-file delta, candidate 0713042ea7f43b8243d63a12af08d948f2e39155 against current main base 523220b8b7a98424a01a58bde450f78e3dca2e13. Candidate-bound local gate evidence verified; source artifacts and qualification limits inspected. No blocking findings.