fix(viewer): self-heal a headless-boot Wayland display wedge - #3155

On cage/Wayland boards (x86, arm64, Pi 5) the compositor enumerates DRM
connectors once at startup. If it boots with no connected display
(headless boot, display off, slow HDMI sync) it binds zero wl_outputs
and never recovers when the display later appears: the viewer container
has no udev to deliver the hotplug uevent to wlroots, so the screen
stays black until the container is restarted. eglfs/linuxfb boards
self-heal for free (Qt exits non-zero on no framebuffer and the restart
policy recreates the container); cage tolerates zero outputs and runs
headless forever.

Add an output watchdog to the viewer's asset loop (_wayland_output_
watchdog): on a Wayland board, if cage has no wl_output while the kernel
reports a bindable display (connector "connected" with a non-empty EDID
mode list) for longer than a 60s grace, exit non-zero so Docker
recreates the container and cage re-enumerates DRM. SystemExit
propagates past __main__'s "except Exception" to a clean exit. Gating on
EDID modes (not bare "connected") avoids restart-looping a genuinely
headless unit or a marginally-seated cable that asserts hotplug-detect
but never delivers EDID.

The restart-policy relaunch alone is racy on Pi 5 (vc4): the fresh cage
can grab the DRM device before the old cage's master release and the
HDMI connector reset drain, so its modeset races a half-reset connector,
EDID is not re-read, and cage comes up headless again. A full
"docker restart" recovers reliably because its stop->start gap lets the
controller settle. Reproduce that gap in start_viewer.sh's cage branch:
before launching cage, when a display is connected, settle briefly then
force a connector re-probe and wait for its mode list to repopulate, so
cage always starts against a settled, EDID-populated connector.

Validated on a Pi 5: the watchdog arm -> exit -> restart -> re-probe ->
bind chain recovers the display end-to-end, and the settle + re-probe
took recovery from ~50% to 12/12 across restart trials. Adds unit
coverage for the watchdog gating and the bindable-display check.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

- _kernel_has_bindable_display() now treats any connector status other
  than "disconnected" (or empty/unreadable) as present, still gated by a
  non-empty EDID modes list — mirroring bin/start_viewer.sh's
  eglfs_has_display(). Some HDMI bridges report "unknown" for a real
  display; keying off "== connected" alone would miss them and stop the
  watchdog from ever self-healing (Copilot review). The modes gate still
  excludes the Writeback connector (unknown status, always modeless).
- Assert the wedge timer with pytest.approx instead of raw float equality
  (SonarCloud reliability bug S1244).

Adds a unit test for the unknown-status-with-modes case.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

…e review)

Two fixes from a high-effort review of the headless-boot self-heal:

- The watchdog treated an empty _wlr_output_names() as "cage has no
  output", but that helper also returns [] when wlr-randr is missing,
  exits nonzero, or hits its 5s timeout (e.g. under sustained
  QtWebEngine GPU load). A tooling failure on a healthy, displaying
  board could therefore accumulate the 60s grace and sys.exit(1),
  restarting a fine display. Add _cage_output_probe() returning
  has-output / no-output / unknown; the watchdog only arms on a
  definitive no-output and degrades to a no-op on unknown, matching how
  the rotation/power paths tolerate the same failure.

- The start_viewer.sh vc4 settle/re-probe forced an "echo detect" EDID
  re-probe on every connected connector on every cage launch, not just
  wedge-restart — needlessly re-negotiating and potentially flashing a
  healthy display on an ordinary boot, and wasting the 5s modes-wait on
  a marginal connector. Gate the re-probe on connected-but-empty-modes
  (the fast-restart EDID-drop symptom); a healthy connector already has
  its modes and is left untouched. The settle sleep still runs so the
  timing fix is unchanged.

Re-validated on a Pi 5: recovery reliability stays 8/8 with the
conditional re-probe, and a healthy boot now logs no re-probe. Adds unit
coverage for the probe classifier and the unknown-failure no-op.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Reorder _wayland_output_watchdog so the cheap _kernel_has_bindable_
display() sysfs check runs before the _cage_output_probe() wlr-randr
call. A genuinely headless board (no connected connector, or a
connected-but-no-EDID cable) now returns early and never spawns
wlr-randr on the asset_loop hot path, nor risks its up-to-5s block per
tick — the subprocess only runs when a display is actually attached.

Every arm/exit decision is unchanged; this only avoids the per-tick
fork/exec when there is nothing to recover. Strengthens the headless-unit
test to assert the probe is not called (Copilot review).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>