recovery: enforce battery and thermal cutoffs after the app exits - #114

What changes

Depends on #113. This draft targets main because the thermal branch lives in a fork; its diff includes both safety changes. The recovery-only diff is sreyassabbani/Insomnia@fix/closed-lid-thermal-cutoff...fix/backstop-safety-checks . Integrate #113 first.

The recovery agent currently honors a future deadline even after the GUI exits, so battery and thermal cutoff rules stop being enforced after a crash. New sessions opt into a versioned, read-only Insomnia --check-safety 5 mode that exits before AppKit starts and uses the same end rules as the app. The existing per-minute agent requires that protocol before calling it; a cutoff, unavailable helper, timeout or unexpected output triggers owned recovery. Legacy session files retain deadline-only behavior.

Arm the helper's lifetime before any read, preserve the recovery lock, and validate an exact one-line response with exit status zero. Expire the saved deadline before undo so failed restoration is retried after cooling. The GUI synchronizes every 30 seconds and before Extend; Extend and relaunch cannot revive a cutoff. No sudoers permissions are added.

Validation at the synced head

Head: b5d0afeaf2842bdbe9edd2eac390693dd547d45f, incorporating upstream e242782584451a4fa4479bbd8f5a5e149d2f254c and thermal branch head af42be5f8a4e92f49080d22b3eb5d6e8b905141d.

• 509 affected tests passed, zero failures and zero skips on October 21. Coverage includes configuration, floor rules/driver, helper decisions, GUI synchronization, session math/persistence, reconciliation, recovery, lid actions, still-running commands, countdown/startup UI, release checks, packaging, isolation, and relevant safety/idle/App Nap script cases.
• Production release build passed with warnings treated as errors. ShellCheck 0.11.0 passed across scripts and CI helper scripts; hidden findings matched the upstream allowlist; system Bash 3.2 syntax and git diff --check passed.
• Reproduced both tests that failed the original PR CI on macOS 26 and 27. The live-session fixture now sets the fake power reading to match its saved ownership, and the still-running-command assertions include the monitored session's extra read. Production recovery behavior was not changed for these test corrections.
• Resolved the spec merge conflict by retaining both independent safety checks and upstream's idle fast path. The initial thermal-branch grouped run had one status-item width test fail; its unchanged isolated rerun and the final 509-test grouped run passed. All results are retained locally.
• The full suite has not been rerun locally at this head. Upstream CI runs separately. Tests use temporary homes and fake machine operations; no live power settings, process freezing, or installation were performed by these tests.

Inspired by Adrafinil's independent monitor and latched cutoff pattern; no code copied. macOS thermal pressure and polling cannot establish safe operation in a backpack.

Real-Mac evidence

Not run for this head: installed-app, crash, relaunch, supervised closed-lid and other affected checks in docs/releasing.md. Earlier October 13 combined-stack installation and partial physical observations refer to the prior head. They do not satisfy the head-specific installed-app report required by CONTRIBUTING.md.

The .greptile/rules.md change documents the recovery protocol and still requires the owner's config approval. This remains a draft subject to acceptance, reviews, CI and hardware evidence.