Fix focus, approval and copy issues found in the v0.2.0 pre-release review

[sudoHG]

Refs #127. Follow-up issues: #158.

Why

The v0.2.0 acceptance on the maintainer's Mac found focus problems one at a time. Before the next attempt, an independent read-only review (Codex gpt-6.1-sol) of all focus/Touch ID paths and of every user-visible v0.2 change was run; the planner verified each finding against the code. Release-relevant findings are fixed here; the rest are filed in #158.

Focus and Touch ID

• After Touch ID, focus returns to Ask Key when Ask Key was in front before the prompt (the authentication process yields back before exiting); it does not when the approval was answered from another app, or when the user switched apps during the prompt.
• The app records its focus and yields to the prompt process before sending its payload, so the prompt cannot activate first (bounded wait).
• Dock-policy events are ignored while a prompt is showing (counted, so overlapping prompts do not clear each other) and the Dock state is reconciled afterwards.
• Repeated Unlock clicks while Touch ID is showing are ignored.

Approvals

• When a retried approval has expired, the next pending request is presented instead of leaving it without a prompt.
• Approval privacy/expiry and idle-lock timers run in common run-loop modes (menus, drags, modal pickers).
• Details mark the requesting Agent's name as self-declared, unverified (ADR 0008).

Copy and import

• Replacing a credential on import keeps its permission; the picker is disabled with an explanation (previously the selected permission was silently ignored).
• Access records describe denied and failed requests as requests ("asked to use…").
• Welcome step 3 matches the saved permission (Allow runs without a prompt; Hidden must be changed first).
• Agent access no longer promises a lookup before every use.
• The sample prompt skips expired credentials.

Checks

• swift build: passed.
• swift test --filter AskKeyAppTests: 345 passed, 0 failed (includes a new welcome-step test; updated assertions for the new copy).
• swift test --filter 'ManagementAuthentication|ManagementDock|AgentApproval|SessionPolicy|VaultViewModel|Unlock': 51 passed, 0 failed.
• python3 scripts/check_hygiene.py, python3 scripts/check_module_deps.py, git diff --check: passed.
• Focus behavior is verified on the maintainer's Mac with the release checklist before notarization.
• Full suite and desktop flows: this PR's CI.