fix: watchdog false-positive cascade - add internal heartbeat

[shipyard-ci]

Closes #21

Summary

Fixed the watchdog false-positive cascade that has been generating 250+ erroneous 'service down' alerts since May 31.

Root Cause

The watchdog was only tracking activity when messages were actively being processed. During normal quiet periods (no incoming messages), the watchdog would timeout and restart the process, despite the service being perfectly healthy.

Solution

Added an internal heartbeat mechanism to the watchdog that operates independently of message processing:

• The watchdog now pings itself every 150 seconds (timeout/4 of default 600s timeout)
• This provides a system-level heartbeat confirming the event loop and scheduler are responsive
• Only triggers a restart if BOTH the watchdog's internal heartbeat AND explicit message pings stop
• This distinction allows normal operational quiet periods while still detecting actual hangs or crashes

Impact

• Eliminates false positives during expected low-activity periods
• Maintains crash/hang detection capability
• Prevents alert fatigue that was reducing incident response effectiveness

Testing

Added three test cases:

1. test_watchdog_internal_heartbeat_prevents_false_positive - Verifies heartbeat keeps daemon alive during quiet periods
2. test_watchdog_handle_ping_resets_activity - Confirms explicit pings from message processing still work
3. test_disabled_watchdog_is_noop - Ensures disabled watchdog mode works correctly

Technical Details

The fix distinguishes between two types of inactivity:

• No message activity (normal) - Quiet periods are expected in operation
• No daemon responsiveness (critical) - Watchdog itself stops pinging, indicating hung/crashed process

This architectural improvement validates operational state before escalating alerts, preventing log-parser misclassifications that were flagging normal logs as failures.