Seven findings, batched into one cleanup PR.

PR #3 (file-watcher) findings:

* watcher.py:30 — drop unused ``import time``.
* watcher.py:336 — type ``_log_future_exception`` parameter as
  ``concurrent.futures.Future`` (NOT ``asyncio.Future``); that's
  what ``asyncio.run_coroutine_threadsafe`` returns. Catch its
  cancellation/state errors plus the asyncio variants so the
  callback can't itself crash on a concurrent cancellation.
* main.py:560 — surface stderr/stdout when watcher mine returns
  non-zero. The rc alone hides 'No mempalace.yaml found' / python
  tracebacks operators need to diagnose.
* main.py:1202 — ``GET /watch`` now double-checks
  ``watcher.is_running`` so a thread crash that flips is_running
  to False between startup and now is reflected in the endpoint
  response. Lifespan still gates publication; this adds defense
  in depth.

PR #4 (mine-queue) findings:

* main.py drain replay — re-apply optional ``extract`` and
  ``limit`` fields. The prior drain dropped them silently, so a
  queue entry with those fields got replayed without. Live /mine
  accepts them; replay must too.
* main.py drain replay — enforce the same safety guards as the
  live /mine endpoint: ``isinstance(dir, str)``, absolute-path,
  no ``..`` traversal, ``mode in {convos, projects}``, ``extract
  in {exchange, general}`` if set, ``limit`` int-coercible if
  set. Without these a queue entry could smuggle through values
  the live endpoint would 400.

Tests: +2 — replay-extract-and-limit (asserts the new fields
make it onto the subprocess argv) and skips-invalid-payload-fields
(5 invalid-payload variants, each correctly skipped pre-spawn).
35 daemon tests pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>