- /rollback-dsh endpoint picks the most recent completed dsh job's
  beforeCommit (skipping no-op and already-rolled-back records); the dsh
  card gains a rollback button with clean-tree guard.
- restart-dsh helper keeps a 15s liveness watch on the respawned process
  and logs exit code/diagnostics to dsh-web.stderr.log instead of
  exiting right after spawn (silent failed restarts were undiagnosable).
- pruneJobHistory keeps only the last 20 job state/spec files.
- client pollJob stops after 20 consecutive read failures and restores
  the buttons; release 0.9.0.