v0.7.3 — a build gets its hour

A working session stops being called idle, and the plugin's own build stops being able to hang or orphan anything.

Fixed

• A 20-minute build is a working session, not an idle one. There is no "still running" hook, so the flat 15-minute cap read any long tool call as idle — and hid its row mid-build. A tool call now gets an hour (a dead one is caught far earlier by the interrupt net and the process reap); thinking keeps 15 minutes, but a transcript still streaming — its mtime moving — extends it. Two tempting designs are recorded in the code as measured dead ends: a tool's transcript is silent by design until completion, and "the process has children" is always true (idle sessions hold their MCP servers).
• A plugin build past its ceiling dies as a group and logs, instead of crashing — or hanging — the SessionStart hook. The whole process group is killed, the compiler's last stderr words land in problems.log, the drain is bounded so an escaped descendant cannot hold the hook hostage, and the inner ceiling (240s) now keeps real margin under the hook's outer 300s — with a test pinning the two apart.
• A hand-edited or foreign JSON file with the wrong top-level shape cannot crash a refresh or a hook. The shape check moved into read_json itself, in all three copies of the helper; 0.7.2 had patched the same class twice at single call sites.

Changed

• The session state machine is out of main.swift and under the model checks — caps and both recovery nets each pinned by a test, the js→swift state-file seam closed from both sides, and model-test timestamps now use the fractional-second format real transcripts write (the bare format only ever exercised the parser's fallback branch).
• The toolchain probe left the menu-open path — warmed once in the background at launch instead of a synchronous spawn inside the first menu open.

The DMG is not notarized (no Developer ID yet): on first launch macOS will object — right-click → Open, or allow it in System Settings → Privacy & Security. The plugin channel and the in-app source build are unaffected.

Full details in CHANGELOG.md.