recovery: enforce battery and thermal cutoffs after the app exits

[sreyassabbani]

What changes

Depends on #113. This draft targets main because the first branch is in a fork; its diff therefore includes both commits. The additional change is commit ad42489, and its independent diff is sreyassabbani/Insomnia@fix/closed-lid-thermal-cutoff...fix/backstop-safety-checks . Merge or rebase after #113 first.

The recovery agent currently honors a future deadline even when the GUI has exited, so battery and thermal cutoff rules stop being enforced after a crash. New sessions opt into a versioned, read-only Insomnia --check-safety 5 mode that exits before AppKit starts and uses the same end rules as the app. The existing per-minute agent requires that protocol before calling it; a cutoff, unavailable helper, timeout or unexpected output triggers owned recovery. Legacy session files retain deadline-only behavior.

Arm the helper's own lifetime before any read, preserve the existing recovery lock, and validate an exact one-line response with exit status zero. Expire the saved deadline before undo so a failed restore is retried even after cooling. The GUI synchronizes every 30 seconds and before Extend; Extend and relaunch cannot revive a cutoff. No sudoers permissions are added.

How it was tested

• Final affected suites: 254 tests, zero failures, including all new helper, script and synchronization regressions, configuration/floor rules, reconciliation, recovery safety, persistence and packaging.
• Before the final cutoff-latching and relaunch guards, the full combined-stack suite ran 1,259 tests: 13 tmux integration cases skipped, zero failures. The final full suite has not been repeated; all affected suites were rerun after those changes.
• Final production release build passed with warnings treated as errors. ShellCheck 0.11.0 passed for scripts and extracted fixture scripts; system Bash 3.2 syntax checks and git diff --check passed.
• Tests use temporary homes and fake machine operations. No live power changes, installation, GUI launch, process freezing or closed-lid test was performed.

New cases cover exact/invalid answers, unsupported protocols, low-battery and thermal decisions, failed configuration or sensor reads, helper timeout and lock release, failed undo with persisted cutoff, GUI cleanup, Extend, and relaunch.

Inspired by Adrafinil's independent safety monitor and latched cutoff pattern; no code copied. This implementation uses macOS thermal pressure and polling and cannot establish safe operation in a backpack.

Real-Mac evidence

Not run: the installed-app, crash, relaunch and supervised closed-lid checks affected by this change, including the new checklist item in docs/releasing.md. The local machine is Apple Silicon on macOS 27.0 with Xcode Swift 6.4; automated tests and a source build are not an installed-app report. The head-specific report required by CONTRIBUTING.md remains outstanding before merge.

The .greptile/rules.md update documents the new recovery protocol and invariant; the owner's config approval is also required by the current merge gate. Opened as a draft for acceptance and review, with no request to bypass either gate.