feat(app): add bounded daemon crash recovery - #221

Summary

Implements the narrow app-managed supervision slice accepted in #202.

• Adds an opt-in automatic daemon restart setting (off by default).
• Retries abnormal exits at most three times with bounded exponential backoff and a visible circuit-breaker state.
• Makes explicit Stop and disabling recovery cancel scheduled or in-flight retries and reap only the exact app-owned process family.
• Keeps restart recipes, including the API key, in memory only and releases them after clean exit, disable, or exhaustion.
• Preserves lifecycle ownership across Pi, Hermes, and OpenCode handoffs using per-launch UUID or PID-plus-launch-date identities, including exact cleanup after restarts.
• Removes one-use Hermes command and receipt artifacts as soon as a receipt is collected so launch secrets are not left on disk.
• Exposes recovery status/count in the app and guards transport, fan, metrics, and client state against stale async completions.

An already-running daemon adopted from a previous app session is intentionally shown as unprotected. The user must start a fresh app-managed daemon before automatic recovery can own it safely.

Scope

This does not claim to fix the underlying Metal out-of-memory crash, persist daemon logs, or add memory telemetry. Those are separate parts of #202 and need their own investigation and validation.

Verification

CPU-only / no model weights:

• Swift parser: all 10 changed/new Swift files
• git diff --check
• DaemonSupervisorTests: 35 passed
• TerminalHandoffLeaseTests: 12 passed
• Full MTPLXApp suite: 593 tests, 1 skipped, 0 failures
• Six high-risk lifecycle/reparenting races: 6 passed, repeated three times
• Post-test process scan: no leaked supervisor or handoff processes

The final diff received independent Terra and Sol review approval before commit.

Closes the app-managed restart slice of #202; leaves the crash root cause, persistent logging, and memory telemetry open.