docs sync + revert auto-unfree removal

revert the earlier 'operator must set allowUnfree' move:
per-agent containers evaluate their own nixpkgs and the operator's
host-level allowUnfree doesn't propagate in. restoring the scoped
allowUnfreePredicate inside both the claude-unstable overlay and
harness-base.nix; documented in README + gotchas as 'nothing to
set on the operator side'.

docs:
- claude.md file map adds crash_watch.rs, kick_agent on coordinator,
  /api/model + journald viewer + bind-with-retry references.
- scratchpad rewritten to reflect the recent run.
- web-ui.md: notification row + browser notifications section,
  state row (badge + model chip + last-turn chip + cancel button),
  per-agent inbox, /model slash, /cancel-question + journald
  endpoints, focus-preservation on refresh.
- turn-loop.md: --model is read from Bus::model() per turn (runtime
  override via /model); recv(wait_seconds) up to 180s with the
  rationale; ask_operator gains ttl_seconds; new TurnState section;
  kick_agent inbox-on-startup hint.
- approvals.md: ttl/cancel resolution paths for operator questions.
- persistence.md: /state/hyperhive-model file.
- gotchas.md: web UI port collision policy (rename, don't probe);
  bind retry + SO_REUSEADDR shape; auto-unfree restored.
- todo.md: cleaned up empty sections and stale entries; /model
  shipped, dropped from the list.

docs/approvals.md

@@ -84,9 +84,9 @@ package legitimacy, cheaper alternative, blast radius) before
 committing and calling `request_apply_commit`.
 
 For ambiguous cases or anything that needs human signal, the
-manager calls `ask_operator(question, options?, multi?)` — queues
-the question on the dashboard and returns the id immediately. The
-operator's answer arrives later as
+manager calls `ask_operator(question, options?, multi?,
+ttl_seconds?)` — queues the question on the dashboard and returns
+the id immediately. The operator's answer arrives later as
 `HelperEvent::OperatorAnswered` in the manager inbox. Storage is
 `hive-c0re::operator_questions` (sqlite); the answer flow is:
 
@@ -96,6 +96,16 @@ POST /answer-question/{id}
   → notify_manager(OperatorAnswered { id, question, answer })
 ```
 
+Two more paths resolve a pending question with a sentinel answer:
+
+- `POST /cancel-question/{id}` (✗ CANC3L button on the dashboard)
+  resolves with `[cancelled]`. The manager sees a terminal state
+  and can fall back.
+- `ttl_seconds` deadline: a tokio watchdog spawned at submit time
+  fires `answer(id, "[expired]")` once the ttl runs out. Already-
+  resolved races no-op. The dashboard surfaces a `⏳ MM:SS` chip
+  on each pending question with a deadline.
+
 ## Helper events to the manager
 
 `Coordinator::notify_manager(&HelperEvent)` enqueues an inbox