Secret prompts (setApiKey and descriptor secrets) previously ran with no
QML-side deadline by design, so a wedged kdialog kept the provider's
actions disabled until the settings page reopened. Give the interactive
prompt phase one long escape-hatch deadline (15 minutes) while keeping
the short noninteractive deadline away from live dialogs, and release
the pending state when it fires. The enforced lifecycle contract in
scripts/test_process_lifecycle.sh is updated accordingly.

Bring providerConfigWatcher under the same stale-source discipline as
the other executable sources: the followed poll name is tracked, a
changed watch command disconnects the old poll and follows the new one,
and replies from a retired poll are disconnected instead of being left
polling on every interval tick.

Close the two reply handlers that ran parsing after their ledger entry
closed: a provider fallback reply now always completes its fallback
queue slot (degrading to a scoped error row), and an account reply
always releases its account lane with a scoped error, so an unexpected
parse failure cannot strand a slot until the next full refresh.

Verification: make check (819 QML assertions passed, 71 skipped for
missing optional KDE modules locally; 71 python tests OK, 1 skip;
kpackagetool6 absent so the AppStream check is a local skip).
Documentation impact: CHANGELOG Unreleased updated; usage guide,
README, and TODO unaffected because no documented behavior, setup step,
or parity status changes.