Replace the fixed post-OTA read_attributes / image_notify / reinterview
sequence with a confirmation step that resolves on whichever signal
arrives first:

- A successful active read of `current_file_version` (kept from the old
  flow as a probe for quietly-rebooting mains devices, but now
  best-effort: exhausted retries no longer abort the post-OTA steps).
- A new `QueryNextImageCommand` whose `current_file_version` differs from
  the value the OTA cluster cached pre-flash. The OTA cluster's listener
  also schedules a re-interview when this happens.
- A `Device_annce` from this device after the post-flash reboot.

If none arrive within `POST_OTA_CONFIRMATION_TIMEOUT` (5 min),
update_firmware() still returns SUCCESS — recovery is deferred to the
version-change listener if the device wakes up later.

After confirmation, a best-effort `image_notify` is sent so the device
refreshes its OTA query cache, and a re-interview is driven directly
unless the version-change listener already replaced this device with a
re-interviewed one.

This fixes the slow-reboot race where the read_attributes retry budget
was exhausted before the device finished rebooting (e.g. Hue LLC020
~102s), causing update_firmware() to throw and skip image_notify and
reinterview.

Claude-Session: https://claude.ai/code/session_01VnDASUDhbLfANUM9UbnAeo

Switch the post-OTA wait's announce signal from a `device.zdo` listener for
`device_announce` to an `application.add_listener` for `device_joined`.

`device_joined` is the existing application-level event for new joins / NWK
changes (including the Device_annce path), so we don't add a new ZDO-level
listener. The version-change signal still covers same-NWK rejoins.

Also adds a test verifying that a `device_joined` event for a different
device does NOT resolve this device's wait.

Claude-Session: https://claude.ai/code/session_01VnDASUDhbLfANUM9UbnAeo

Sleepy end devices only receive requests for a short window after they
send something themselves. Add a small named-action registry on
`Device`: `register_checkin_action()` queues a coroutine factory that is
run whenever the device shows signs of being awake (any inbound packet,
or a stack-reported join/announce). The coroutine returns `True` to
unregister the action or `False`/raises to retry on a later check-in,
gated by a per-action cooldown (default 5 minutes) so a frequently
reporting device does not hammer a failing action.

Actions run as application tasks, not device tasks: device-owned tasks
are cancelled when a re-interview swaps the device object, which would
cancel an action that is itself driving the re-interview.

Poll Control check-ins now also request fast polling while check-in
actions are pending, keeping the device awake for the queued work.

Claude-Session: https://claude.ai/code/session_01VnDASUDhbLfANUM9UbnAeo

- Re-registering an existing action now mutates the stored
  `_CheckinAction` in place instead of replacing it: a running attempt
  unregisters itself by object identity on success, so a replacement
  object would have left completed actions permanently registered.
- Document why neither `remove_checkin_action()` nor `on_remove()`
  cancels a running attempt: `_device_reinterviewed()` calls the old
  device's `on_remove()` mid-swap, and an action driving that very
  re-interview must not cancel its own call stack.

Claude-Session: https://claude.ai/code/session_01VnDASUDhbLfANUM9UbnAeo

Add a `reinterview_pending` flag to `Device` (a request timestamp,
mirroring `last_seen`), settable via the public
`schedule_reinterview_on_checkin()`. While set, a check-in action is
armed that drives `reinterview()` whenever the device is next heard
from, retrying on later check-ins (with a cooldown) until the
re-interview succeeds. The flag setter fires
`device_reinterview_pending_updated` so it can be persisted.

Post-OTA wiring: `update_firmware()` queues the re-interview right
after a successful flash, before waiting for confirmation — a sleepy
end device that misses the whole confirmation window is re-interviewed
when it next reports in. The confirmation wait also resolves when a
`device_reinterviewed` event for the device fires (e.g. the check-in
path already completed the re-interview mid-wait). The OTA cluster's
version-change listener queues the flag too, so its immediate
re-interview attempt is retried if the device goes back to sleep.

A successful re-interview clears the flag on the new device object; the
flag is deliberately not copied to the re-interview shadow. `clone()`
copies the raw field without firing events or arming actions. The
coordinator itself is never queued.

Claude-Session: https://claude.ai/code/session_01VnDASUDhbLfANUM9UbnAeo

Schema v16 adds a `reinterview_pending` column to the `devices` table
(REAL request timestamp, 0 = none). The flag is written whenever
`device_reinterview_pending_updated` fires and on the full device save,
and restored in `_load_devices()`, where the property setter re-arms
the re-interview check-in action. The restored flag is copied across
the quirk/resolver swap during `load()`, like `original_signature`.

This makes post-OTA recovery for sleepy devices survive restarts: if
zigpy restarts while a device is still rebooting from a flash (or
before it ever woke up again), the queued re-interview is re-armed on
startup and runs when the device next checks in.

Claude-Session: https://claude.ai/code/session_01VnDASUDhbLfANUM9UbnAeo