feat(flow): on-demand host handoff with reliable return and a back-tap tip

Keyboard
- Only jump to the app when the voice surface is shown (tab tap / opened
  there); typing tabs no longer leave the host on keyboard open.
- Wait up to 0.4 s for the arbiter to report the host app before leaving,
  and late-bind an id that arrives within 6 s of the jump.
- Empty arbiter callbacks no longer wipe an already captured host id;
  install the capture handler in every build configuration.

App
- Return to the previous app with up to four retries using iOS's real
  open result, and honor the skip-app-switch preference.
- Keep the pending host id across cold-start zombie reconciliation, and
  expire it after two minutes (legacy values without a timestamp stay valid).
- Show a light tip pointing at the system back control when we cannot
  return automatically ("点击返回，立即使用").

Tests: TTL behaviour and return retry policy.

OSGKeyboardShared/Services/FlowSessionKeys.swift

@@ -34,6 +34,11 @@ public enum FlowSessionKeys {
     public static let audioLevels = "flow.audioLevels"
     /// Bundle id of the app that opened `osgkeyboard://startflow` (scheme D).
     public static let pendingHostBundleId = "flow.pendingHostBundleId"
+    /// Wall-clock of the last `pendingHostBundleId` write; drives the TTL below.
+    public static let pendingHostBundleIdAt = "flow.pendingHostBundleIdAt.v1"
+    /// A recorded host older than this is never a valid return target — the user
+    /// has long since moved on, and jumping there would be a wrong-app surprise.
+    public static let pendingHostBundleIdTTL: TimeInterval = 120
     /// Wall-clock of the last keyboard→`startflow` PiP arm attempt (debounce re-jumps).
     public static let lastPiPArmAttemptAt = "flow.lastPiPArmAttemptAt.v1"
     /// Minimum gap between repeated proactive `startflow` jumps.