fix(runtime): bg-worker watchdog — revert process-gone runs' TODOs (#22 bg half)

[rz1989s]

#22 — background worker-disappearance watchdog (the bg half)

Closes the bg half of #22. The foreground half (empty success from a prompt() that resolves with no assistant message_end) was fixed by PR #30's EMPTY_RESULT guard. With both halves done, #22 can close.

Root cause (bg half)

A bg worker that exits without a terminal record (host sleep, crash, pi restart mid-run) left its linked fleet TODO stuck in_progress forever. reconcileRuns already marked the run aborted in the durable RunLog + in-memory RunRegistry (v0.10.2, probe-driven, periodic via the widget's 60s timer + on session_start), but it never transitioned the TODO — the cross-session tracking entry stayed in_progress with no path to recovery. (This was the exact repro in #22's comment: run fl-msb903yr, worker gone, worktree clean at base, fleet TODO td-msb90400zllurj stuck in_progress.)

Fix

reconcileRuns now accepts an optional todoSync: TodoSyncPort. When it marks a run aborted (process-gone), if the run has a todoId (the RunLog meta carries it), it best-effort awaits:

todoSync.markRunTodoReverted(todoId, undefined, "WORKER_EXITED_WITHOUT_RESULT: process gone (probe)")

→ reverts a fleet-created TODO to open (retryable) + appends the diagnostic note. The link path only accepts open/in_progress TODOs, so reverting to open is the correct recovery for a linked one too (its prior was open/in_progress). Wrapped in try/catch — best-effort (the run is already marked aborted in the log + registry).

reconcileRuns is now async (returns Promise<string[]>). Callers fire-and-forget it so the session_start asyncRunner setup isn't blocked:

• index.ts session_start: void reconcileRuns(...).then(notify).
• fleet-widget.ts 60s liveness timer: void reconcileRuns(...).catch().
• FleetWidgetDeps += todoSync?, wired in index.ts widget construction.

Tests

4 new #22 tests in reconcile.test.mts:

1. process-gone run with a linked TODO → reverted to open + WORKER_EXITED_WITHOUT_RESULT note.
2. no todoId (track:false) → no todoSync call.
3. todoSync optional (back-compat: callers not wiring it) — run still aborted.
4. failing todoSync (deleted TODO) is best-effort — run still aborted, no throw.

Existing reconcile tests converted to async/await.

Verification

• pnpm typecheck — clean
• pnpm test:run — 609/609 pass (was 605, +4)
• git diff --check — clean

Closes #22 (both halves now done).