Add systemd/launchd supervision and uploader liveness monitoring (fixes #223)

[wjllance]

Summary

The maker and its OpenObserve log uploader had no process supervisor. An unexpected death was neither restarted nor alerted; a uploader dying mid-run only surfaced as a stale dashboard; and on SIGKILL/power loss the un-ingested tail of the local log was stranded until a manual catch-up. This PR adds supervision units for both platforms (Linux prod / macOS dev), hardens the wrapper to keep the uploader alive, and adds a boot/crash catch-up — while keeping the design rule that an intentional fail-safe exit is NOT auto-restarted.

Exit-code policy

A fail-safe shutdown is a deliberate, safe stop that needs a human, so it must notify but must not auto-restart; an unexpected death must be restartable. To let supervisors tell them apart, the maker now emits a dedicated exit code.

Exit code	Meaning	Restart?	Notify?
0	Clean stop (Ctrl+C / SIGTERM)	No	No
75	Intentional maker fail-safe (order-response loss, 3 consecutive cycle errors, position-reconciliation failure, residual-order cleanup failure)	No	Yes
1	Startup / config / validation error	Yes (loop-limited)	Yes
101 / signal (137…)	Panic, OOM kill, unexpected death	Yes	Yes

75 is FAIL_SAFE_EXIT_CODE in crates/standx-cli/src/commands/maker/model.rs, returned via a typed FailSafeShutdown error and mapped to the exit code in main. systemd enforces it with RestartPreventExitStatus=75 + OnFailure=; launchd (no per-code exclusion) uses a translator that maps 75→0 and pairs with KeepAlive.SuccessfulExit=false.

Files added

• deploy/systemd/standx-maker.service — maker via the observed wrapper (co-runs the uploader); Restart=on-failure, RestartPreventExitStatus=75, OnFailure=standx-notify@, crash-loop limit.
• deploy/systemd/standx-openobserve-catchup.service — boot oneshot, ordered before the maker.
• deploy/systemd/standx-notify@.service + standx-notify.sh — OnFailure webhook/journal notifier.
• deploy/systemd/maker.env.example — EnvironmentFile template.
• deploy/launchd/com.standx.maker.plist + standx-maker-supervise.sh — exit-code translator + KeepAlive.
• deploy/launchd/com.standx.openobserve-catchup.plist — RunAtLoad catch-up agent.
• deploy/README.md — install for both platforms + exit-code policy.
• scripts/openobserve_catchup.sh — idempotent, incremental crash/boot re-upload of the un-ingested tail.

Changed: scripts/run_maker_observed.sh now polls the uploader while the maker runs and relaunches it (with a stderr/webhook notice) if it dies mid-run; Rust exit-code plumbing in main.rs, commands/mod.rs, and the maker model.rs/mod.rs/runtime.rs.

Test plan

• cargo fmt -- --check, cargo clippy --workspace --all-targets -- -D warnings, cargo test -p standx-cli (new unit tests assert fail-safe→75 and generic→1, including the anyhow→Box downcast path).
• bash -n on every shell script added/edited; plutil -lint on both plists.
• Smoke-tested the reworked wrapper end-to-end (stub maker, supervision loop, log capture, exit-code propagation) and the catch-up script's skip/no-op paths.
• Live gate STANDX_ENABLE_LIVE_MAKER untouched; all units default to paper.

Fixes #223

🤖 Generated with Claude Code