feat: daemon decision journal for introspection (TODO-003)

[tsilenzio]

Summary

• Always-on append-only decision journal at ${VIGIL_RUNTIME_DIR}/daemon.log (src/journal.rs): one JSON line per decision change (active, want_hold, battery_capped, hold_since, on_ac, charge, wake reason, pid), a 60s heartbeat so a quiet daemon is distinguishable from a wedged one, and start/exit lines so exit reasons (idle, disabled, self-upgrade) survive the daemon.
• Appends do not fire the runtime-dir watch, so the daemon never wakes itself, and the page cache preserves every line written before a SIGKILL. Writes are best-effort and rotate aside past 1 MiB.
• vigil status reads the newest entry and reports the daemon's own last decision with the hold/release reason, plus a staleness verdict (wedged vs gone vs cleanly exited).
• Marks TODO-003 built with the settled parameters.

Test plan

• cargo fmt --check, cargo clippy --all-targets --all-features -- -D warnings, cargo test (28 tests) green locally
• End-to-end in a sandboxed VIGIL_RUNTIME_DIR: idle lifecycle (start/decision/exit-idle), hold cycle with a live pid (holding decision with hold_since, reactive release on process death with wake=process-exit), mid-hold vigil status rendering, and the disabled exit reason
• CI (macOS check/test/clippy/fmt, conventions)