[Bug]: MX Master 3S Bluetooth-direct is online but DPI and SmartShift reads/writes fail on macOS 27

### Pre-flight

- [x] I searched existing issues and this is not a duplicate.
- [x] I am on the latest release.
- [x] Logi Options+ is fully uninstalled and no Logitech control processes are running.

### Environment

- **OpenLogi:** 0.7.4 (GUI and agent, IPC protocol 23)
- **OS:** macOS 27.0, build 26A5416b, Apple Silicon (arm64)
- **Device:** Logitech MX Master 3S
- **VID / PID:** 046d / b034
- **Firmware:** RBM22.01_0006
- **Connection:** Bluetooth direct, no receiver
- **Permissions:** Accessibility, Input Monitoring, and Bluetooth all shown as Granted in OpenLogi

### What happened

The MX Master 3S is paired directly through macOS Bluetooth and OpenLogi discovers it as online, including battery status. However, live HID++ controls fail:

- The Pointer page shows **"Couldn't read DPI — click to retry."**
- It also shows **"Couldn't read SmartShift — click to retry."**
- Retrying does not recover either read.
- Changing SmartShift mode/settings in the UI has no effect on the mouse.
- The mouse continues working normally as a pointer.

Expected: OpenLogi should read the current DPI and SmartShift state, and SmartShift changes should be applied to the mouse.

The problem persists after a full Mac restart, power-cycling the mouse, and restarting the OpenLogi agent. This appears related to #316 and the Bluetooth HID++ control-path failure described in #468, but this report covers MX Master 3S + Bluetooth-direct + OpenLogi 0.7.4 + macOS 27, with the device online while both DPI and SmartShift transactions fail.

### Steps to reproduce

1. Pair an MX Master 3S directly in macOS System Settings → Bluetooth.
2. Grant OpenLogi Agent Accessibility and Input Monitoring permissions.
3. Ensure Logi Options+ is not installed or running.
4. Launch OpenLogi 0.7.4.
5. Open the MX Master 3S device card, then the Pointer tab.
6. Observe "Couldn't read DPI — click to retry."
7. Observe "Couldn't read SmartShift — click to retry."
8. Click either retry control or change the SmartShift mode.
9. Reads continue to fail and the mouse wheel mode does not change.

### OpenLogi diagnostics

~~~
### OpenLogi Diagnostics

App
- OpenLogi (GUI): v0.7.4 (release)
- Agent: v0.7.4 (connected)
- IPC protocol: GUI 23 / agent 23
- Inventory: ready
- OS: macOS 27.0 (arm64)
- Locale: en-GB (UI: follow system)
- Accessibility: granted · Input hook: installed
- Config: schema 4 · 1 configured device(s) · thumbwheel 14

Devices (1)
- MX Master 3S — mouse (codename: MX Master 3S)
- Connection: Bluetooth (direct) · Online: yes · Battery: 85% (discharging, full)
- Capabilities: buttons=yes, pointer=yes, lighting=no
- DPI: read failed
- Model: 0b034 (model-ids: b034/0000/0000, ext-model: 00)
-

Start by reproducing the failure from the MX Master 3S device card's Pointer tab with a direct Bluetooth connection, then review the OpenLogi diagnostics and related issues #316 and #468. Trace the agent's DPI and SmartShift control path; done means both values can be read and SmartShift changes are applied on macOS 27.

Written by the indexing model from the issue text.