Phase 3d: didModifyServices, re-discover every connection, restore discovery (FR-10.5–10.6)

[itsniper]

Parent: #52

Requirements

• didModifyServices: mark not ready, park/fail discovery-dependent I/O, re-discover, re-arm subscriptions, surface event (FR-10.5.1).
• Re-discover on every new connection; never reuse CB service/char refs across connections (FR-10.6.1–10.6.2).
• Restore: discard catalog, re-discover intended peripherals, re-apply subscription intent; restored link is not ready (FR-10.6.3).
• Document OS GATT cache / Service Changed 0x2A05 limitation (FR-10.5.3).

Acceptance criteria

• Modify-services path re-gates and recovers to ready (or fails closed)
• Post-disconnect CB GATT refs not reused
• Restore path runs discovery + intent (tests as mocks allow; track State-restoration test fidelity: simulate willRestoreState in CoreBluetoothMock (retire actor-boundary-only coverage) #42)
• DocC documents FR-10.5.3 limitation