A device raises a phone approval (device only)

The computer is waiting for its owner: a command its local agent composed (kind: command) or a session an agent asked for (kind: session). Salt keeps the question, puts a task in the owner's bell ("<Computer> is waiting for you"), notifies them, and delivers their answer to the device as a device_ask delivery ({type: "device_ask_answered", kind: "device_ask_answered", ask_id, decision}). Idempotent on ask_id: repeating the call returns the same ask with 200 and tells nobody again. A device holds at most 5 open asks. The ask lives as long as the task that waits on it (60 to 900 seconds): approving it later would run a command against a changed computer, so an expired ask is restarted by asking the agent again.