Preserve pending timer controls across failed loads and remote conflicts #131

Release review found two durable notification recovery bugs in #130: failed initial reads can acknowledge and drop pending native actions, and acknowledgement can rebase concurrent stale actions onto a newer remote timer version. Keep replay unavailable until state loads, and require the acknowledged version before retaining successor actions on Android and iOS.

Add failure/retry and native journal regressions. Follow-up to #123. Related requirements: FR-5_1 (PapyrusReader/docs#34), FR-5_3 (PapyrusReader/docs#36), FR-6_3 (PapyrusReader/docs#39).