Push a 2FA/OTP code into a blocked thread #290

Inspired by Skyvern's TOTP push API (an external system pushes a code into a running, waiting task; it extracts digits from a forwarded SMS/email automatically).

When a worker is blocked on a verification code, the user (or an email/SMS webhook automation) can push the code into the thread from the phone companion or the UI, and the agent resumes. Small, concrete, and nobody in coding-agent land does it.