fix(state): wire up wait_for_stable_ui dead config field

[lesurJ]

wait_for_stable_ui was read into AgentConfig but never consumed anywhere in the codebase, so a well-formed-but-stale accessibility dump (e.g. a WebView a11y bridge lagging behind a client-side route change) was accepted immediately with no retry; this wires the setting into fetch_state_with_retry/AndroidStateProvider, adding a bounded re-poll loop that waits wait_for_stable_ui seconds and compares consecutive a11y_tree dumps, returning as soon as two agree (or giving up after _MAX_STABILITY_CHECKS rounds), with droid_agent.py now passing the configured value through instead of it silently doing nothing.