Defer subsystem request replies until handler decision

[blaubaer]

Summary

• Add opt-in deferred subsystem handlers with a one-shot reply and named/default lookup, after existing validation and policy checks.
• Preserve per-channel reply order without an unbounded request queue; reject and close on errors or decision timeout without sending an exit status in place of failure.
• Bound stalled reply writes and retain session limits while a rejected handler winds down. Existing shell, exec, and ordinary subsystem handlers keep their behavior.