…ty, sweep race

Hardens the gateway against operational issues observed on long-running deployments. Bundled changes:

**Connection resilience**
- HEARTBEAT_MS raised from 180s → 300s. Baileys' executeInitQueries and fetchProps legitimately exceed 60s after long sessions; 180s burned the gateway on every reconnect.
- scheduleReconnect() helper. The previous setTimeout(()=>startConnection().catch(...)) inside the close-handler stranded the gateway when startConnection threw before the new sock's connection.update listener was installed: no future event source meant no future retry. The helper self-reschedules on retry-throw so the in-process recovery loop stays alive end-to-end.
- Quiet link-preview-js warnings. Advisory-only, fill stderr.
- connection.update handler consolidated. Multiple registrations were stomping each other on hot-reload.

**Dedup + retransmit**
- dedupTracker window 60s → 600s. The 1min window was too tight for retransmits arriving after a Signal session-recovery round-trip.
- Two-phase API: wasProcessed(id) / markProcessed(id) so retransmits of decrypt-failed messageIds reach the recovery handler instead of being dedup-skipped.

**Crash safety**
- WAL checkpoint + db.close() on graceful shutdown — prevents 'database is malformed' after SIGTERM.
- Persist cached agent UUID across restarts (was re-resolved from API on every boot, which failed when the API was slow to come up).

**Outbound delivery**
- sendOrEdit rewritten with try/catch + bounded STREAM_EDIT_MAX_FAILURES backoff. After 3 consecutive edit failures the streaming path bails and the final delivery handles full text in one send.
- Snapshot sock at callback entry as localSock — guards against the global sock being nulled out by a concurrent reconnect between existence check and sendMessage await.
- Quoted-reply prefix now covers all media types (was text-only).
- Structured send_message_outbound log lines (stream_first, edit_final, new_message) for prod observability.

**Catch-up sweep race + shutdown drainage**
- processing_since SQLite column on the message store. Two concurrent sweep cycles (boot + watchdog re-arm) were racing each other.
- catchUpInterval + dbCleanupInterval handles captured at module scope so gracefulShutdown can clearInterval them alongside heartbeatInterval / gapDetectionTimer. Without this, runCatchUpSweep / runDbCleanup ticks could resume after db.close() and write to a closed handle.
- runCatchUpSweep checks shuttingDown at entry AND between iterations, so a paused inter-iteration setTimeout doesn't resume into dbIncrRetryOrFail / dbSaveMessage post-shutdown.
- Inter-iteration setTimeout is unref()'d so the event loop exits ~CATCHUP_INTER_DELAY_MS sooner per pending iteration during shutdown.

**Health probe**
- New scripts/health-check.sh for container probe and ops dashboards.

Verification:
- node --check: passes
- node --test: 88 unit tests pass (dedup 8, echo 15, group-roster 5, identity 41, lid-cache 14, session-key 6)
- Live deploy tested on the fork's NAS for 48h — no false-positive heartbeats, no double-deliveries.

(cherry picked from commit 56ca169)

… polish

Three small follow-ups from review on #4851:

1. **sendOrEdit new-message branch try/catch.** The edit branch already
   swallows mid-await throws (stale streamMsgKey, sock half-closing
   between snapshot and sendMessage) and returns the streamed key as
   "last visible chunk is final". The new-message branch left the
   throw uncaught, so the same race in a fallback delivery would crash
   the message handler. Mirror the edit branch: try/catch, log
   `kind: 'new_message_failed'`, return null. Caller already handles a
   null return (same shape as the entry-snapshot bail-out).

2. **health-check.sh portability comment.** Top-of-file note that the
   script is Linux + PM2 only — uses GNU `stat -c %s` and
   `nslookup -timeout=3`, won't run on a macOS dev host. Saves the next
   reader 5 minutes of confusion when a quick local sanity-run silently
   does the wrong thing.

3. **pm2_restart faithful exit code.** `pm2 ... | while read` lets the
   `while`/`done` exit status (always 0) mask pm2's real status. Capture
   `${PIPESTATUS[0]}` so the function's boolean signal isn't a lie.
   `set -o pipefail` is already on, so this just makes the pre-existing
   intent explicit. Today's caller does `|| true`; this prevents a
   future caller from acting on a fake success.

Verification:
- node --check packages/whatsapp-gateway/index.js  (clean)
- bash -n packages/whatsapp-gateway/scripts/health-check.sh  (clean)
- node --test packages/whatsapp-gateway/index.test.js
  → 132/134 pass — the same 2 pre-existing flakes (`onOwnerNotice`
  ECONNRESET and `LIBREFANG_DISPATCH_LOG=off` forward_dispatch) the
  prior commit identified, both in HTTP/forward harness layers
  unrelated to the sendOrEdit closure or the bash script.