Allow initial Recovery Kit confirmation after a sharing warning is acknowledged #85

Status: ready-for-agent

Initial Vault creation aborts when a detected sharing app remains running after the owner acknowledges the warning. start_session() resets that acknowledgement as creation enters the pending Recovery Kit phase. The native coordinator's immediate ConfirmRecoveryKit action then fails with the guard up and discards the unsaved candidate. This was reproduced with a newly built, isolated fictional Vault; no real credential or owner Vault was used.

Keep session-generation and idle-timer initialization at creation, but defer only its guard reset until the initial Kit confirmation saves successfully and opens the Vault. Apply the shared correction to both legacy and native creation. Ordinary unlock, Quick Unlock and copy installation must still reset immediately; rotation must keep its existing behavior. A new/restarted capture app, cancellation, focus loss or timeout must still invalidate and wipe pending work. Do not dismiss a new app set or disable the guard.

Acceptance: focused regressions for acknowledged unchanged-app creation/Kit confirmation, shared legacy behavior, app-set invalidation and pending-Kit idle expiry; strict checks and the fresh fictional Mac flow. No new dependency or network access. Native activation and actual Touch ID acceptance remain tracked separately in #58/#71 and PRs #63/#72.