umbrella(mobile): safe Orca Lead controls

## Umbrella: safe Orca Lead controls on mobile

Mobile Orca collaboration is intentionally read-only for Worker orchestration. This umbrella tracks the bounded actions that may safely be exposed for the **Lead** without allowing mobile users to mutate Workers, queues, team topology, permissions, or session history.

## Capability boundary

Every action must be Lead-only, server-validated, scoped to the current session, and idempotent where retries are possible. Worker orchestration remains unavailable on mobile:

- no Worker queue edits, interjects, deletes, reordering, or merges;
- no Worker creation, archive, pause, resume, or focus changes;
- no team start/end or topology changes;
- no confirmation that triggers external side effects;
- no permission, model, workdir, fork, rewind, archive, or history mutation.

## Tracked work

- [x] **Resume quota-limited Lead** — allow an Orca Lead in `usageLimited` state to resume from mobile. Implemented by [#4408](https://github.com/makecindy/cindy/pull/4408); related visibility work: [#4395](https://github.com/makecindy/cindy/issues/4395), [#4396](https://github.com/makecindy/cindy/pull/4396), [#4400](https://github.com/makecindy/cindy/pull/4400).
- [ ] **Retry failed Lead turn** — only where the existing retry is safe and idempotent; preserve the Worker orchestration gate. Related: [#4325](https://github.com/makecindy/cindy/pull/4325).
- [ ] **Clear recoverable Lead error** — clear only a recoverable Lead-local error state.
- [ ] **Stop current Lead turn** — stop the active Lead turn without ending the team or changing Workers.
- [ ] **Retry transient message delivery** — retry only when the server can prove the message was not accepted, avoiding duplicate execution.
- [ ] **Informational status actions** — expose Worker progress and acknowledge notices only when the action has no execution side effect.

Normal user messages to the Lead are already supported by the existing mobile collaboration behavior.

## Acceptance criteria

- Each child capability has an explicit mobile gate and server-side validation.
- Unsupported Worker and orchestration operations remain read-only.
- Non-Orca sessions retain their existing behavior.
- Each completed item has focused regression coverage and links its implementation PR here.

No files, tests, or entry points are named. Start by reviewing the existing mobile collaboration behavior and related PR #4325, then split one unchecked capability into a focused change. Done means the action has an explicit mobile gate, server-side validation, focused regression coverage, and an implementation PR linked here.

Written by the indexing model from the issue text.