feat(agent): restore native keyboard platform on reconnect

[hornej]

Summary

Add an opt-in agent policy that restores a compatible keyboard's native host platform when it appears, reconnects, or resumes. The policy selects Windows on Windows, macOS on macOS, and Linux on Linux by resolving the device's advertised HID++ 0x4531 descriptors.

The draft is Windows-validated. macOS build and repeated Windows-to-macOS KVM validation are still pending, so this PR is not ready for review yet.

Changes

• openlogi-hidpp: add the function-3 host-platform setter and correct the capability/OS masks to the byte representation observed on MX Keys hardware.
• openlogi-device / openlogi-hid: resolve a requested OS through advertised descriptors, write the concrete current host slot, and verify the result with a readback.
• openlogi-agent-core / openlogi-agent: remember keyboard routes, revoke stale capture channels on topology changes, reserve a reconnect recovery window, and reapply the opt-in policy on reconnect and normal volatile-setting refreshes.
• openlogi-core / openlogi-ipc: add the configuration flag and append the new wire operation with protocol version 28.
• docs: document app_settings.enforce_native_keyboard_platform (default false).

Testing

• cargo fmt --all -- --check
• RUSTFLAGS="-D warnings" cargo clippy --workspace --all-targets -- -D warnings
• RUSTFLAGS="-D warnings" cargo test --workspace
• cargo test -p openlogi-ipc --test wire_format
• cargo check -p openlogi-hidpp -p openlogi-device --target wasm32-unknown-unknown
• cargo check -p openlogi-core --no-default-features --target wasm32-unknown-unknown
• typos --config .config/typos.toml .
• cargo xtask release check-publish
• Branch-specific rustdoc passed with openlogi-permissions excluded. The repository's exact Windows rustdoc command still fails on the unchanged PermissionStatus::Unknown link in openlogi-permissions; the same link is present on origin/master and the type is cfg-excluded on Windows.
• Windows hardware: MX Keys through Unifying receiver 046d:c52b, slot 1. With the standalone helper executable disabled, repeated macOS-to-Windows KVM reconnects logged first-attempt Windows platform verification and independent HID++ readback reported Windows with software source. Normal shortcuts were physically verified after reconnect.
• macOS: build/install the branch agent, remove the temporary per-device Option/Command mapping, and verify repeated Windows-to-macOS KVM reconnects select the advertised macOS platform with natural modifier behavior.

The temporary Windows helper and macOS modifier mapping remain available as fallbacks until the macOS validation above passes.

Related to #521