weekly-run: tree-aware idle signal + crash-proof watchdog

More fixes from live-running the finish of the 2026-07-03 run:
- _session_idle_min(): measure staleness across the whole session TREE (top-level
  run + all descendant subagents), via the opencode server time.updated, NOT the
  tmux log mtime (which freezes when a headless run doesn't stream to the pane).
  A per-recipe subagent deploy runs 20-40min during which the PARENT session's
  updated time is stale — reading the parent alone looked 'idle' and would false-
  resume, killing the productive run. Renamed from _log_idle_min (kept as alias).
- watchdog(): wrap each poll in try/except so a transient server blip/race can
  never kill the watchdog (a dead watchdog silently abandons the run).
- watchdog + supervisor now read the tree-aware session idle instead of log mtime.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WxbpH3DquKzoSTSwGvGuET

cc-ci-plan/launch-supervisor.py

@@ -123,7 +123,7 @@ def _gate():
     # misreads a headless `opencode run` as idle). Trust the run PROCESS + the session log's mtime:
     # a live `opencode run … -s <sid> --attach` proc, or a log touched within the stall window.
     pids = lu._run_pids(sid)
-    idle = lu._log_idle_min()
+    idle = lu._session_idle_min()
     if pids or (idle is not None and idle < lu.STALL_MIN):
         via = f"{len(pids)} live run proc(s)" if pids else f"log idle {idle:.0f}m < {lu.STALL_MIN:.0f}m"
         return False, sid, f"upgrader run progressing ({via}) — leaving it"