hive-sh4re + docs: extract Ask/Answer routing prose (#717 batch 2)

docs/conventions.md

@@ -108,6 +108,42 @@ each id in a per-recipient in-memory set so the next `Recv` can tag
 the row with `redelivered: true`. Idempotent + cheap when there's
 nothing in flight, so the at-boot fire is unconditional.
 
+### Question routing (Ask / Answer)
+
+`AgentRequest::Ask` (and the manager-flavour mirror) surfaces a
+structured question that either lands in the operator's dashboard
+queue or in a peer agent's inbox. The recipient is the `to` field:
+
+- `to = None` or `to = Some("operator")` — routes to the
+  operator-question queue. The dashboard renders the question with
+  any `options` as a chip strip plus a free-text fallback (`Other…`)
+  so the operator is never trapped by an incomplete list. The
+  legacy `AskOperator` variant collapses into this case.
+- `to = Some(<agent>)` — peer Q&A. The target agent receives a
+  `HelperEvent::QuestionAsked { id, asker, question, options, multi }`
+  in their inbox. They reply via `AgentRequest::Answer` (or
+  `ManagerRequest::Answer` if they're the manager); the answer
+  threads back to the asker as a `HelperEvent::QuestionAnswered`
+  event.
+
+Shape fields are uniform across both targets:
+
+- `options` is advisory — the dashboard chips are decoration over a
+  free-text fallback; peer-agent recipients see the list in their
+  `QuestionAsked` event and can return any string.
+- `multi = true` lets the answerer pick multiple options (checkboxes
+  in the dashboard, a hint in the peer-agent event). The answer
+  comes back as a single string with selections joined by `", "`.
+- `ttl_seconds` auto-cancels with answer `[expired]` (and `answerer:
+  "ttl-watchdog"`) when the wait becomes moot. `None` = wait
+  indefinitely or until manual cancel.
+
+Response shape is always `QuestionQueued { id }` — the asker stores
+the id and correlates the asynchronous answer event when it lands.
+Authorisation on `Answer`: only the question's `target` agent (or
+the operator via the dashboard) is permitted to reply; an answer
+attempt from anyone else fails the wire-side check.
+
 ### Loose-ends wire shape
 
 `LooseEnd` is the per-row response shape for `GetLooseEnds` (both