Connect Completion Hook

The provider's completion push: wake the ACP session that asked.

The signed hook token is the authority — only Stormy could have minted it, and only the connect provider was told the URL. The wake reuses the agent reminder machinery (one durable agent.run schedule into the bound session), deduped on freshly read canonical provider state so equivalent provider retries collapse.