Orphaned permission and deferred tool resume moved into one shared generator

The query loop previously handled two resume paths, resuming an orphaned permission request and resuming a tool deferred by a hook, as separate inline blocks each building their own early result. Both now delegate to a single shared generator that takes both candidates plus an earlyResult descriptor, so the availability check and result shaping (including the "tool_deferred" and "tool_deferred_unavailable" stop reasons) live in one place instead of two.