Compute the secret-command deadline from both process phases, their kill
graces, and a delivery margin. The previous 900-second deadline could
disconnect the command after a late submission while its save was still
within the CLI timeout.

Record the watched source before connecting it. Plasma can deliver a cached
reply synchronously; previously this callback disconnected the new source.

Add production-function tests for cached watcher replies and generated
secret-prompt commands with synthetic processes. Both new regressions fail
on a2d7152 and pass after the fixes.

Documentation impact: update CHANGELOG Unreleased, provider setup guidance,
and development test descriptions. Correct the account-error rationale.
README, TODO, config keys, translations, metadata, and packaging are
unaffected; this does not change a CLI contract or parity requirement.