feat(watchdog): sidecar-watchdog F1b — monitoring brain in a separate container (ORCH-100)

Add the `watchdog/` package (thin Python-3.12 stdlib-only daemon) and the
`orchestrator-watchdog` compose service — the brain half of the domain-0
observability pair. F1a (ORCH-099) exposes GET /metrics raw signal; F1b reads it,
augments with host / container / dependency probes, runs each signal through a
generalised pure decision function (decide(signal_active, prev, now, cooldown),
a strict superset of disk_watchdog.decide_action) with per-signal in-memory
dedup/throttle/recovery, and alerts over its OWN independent Telegram channel.

Key properties (ADR-001):
- Observer separated from observed: separate container; /metrics not answering is
  itself the master `orch_down` alarm (debounced K ticks — no flap on a hiccup).
- Strictly read-only: docker.sock GET-only + mounted :ro (double guard), host
  paths :ro, no DB/disk writes, no process control — self-hosting-safe.
- never-raise on three levels (per-source/per-tick/per-send) + WATCHDOG_ENABLED
  kill-switch (disabled -> inert idle-loop, not exit).
- Disk anti-duplicate (D6): disk_watchdog (ORCH-063) stays sole owner of the 85%
  alert; sidecar carries orch_down + an opt-in 97% ceiling (default off).
- NO import from src/** (C-1); src/**, STAGE_TRANSITIONS, QG_CHECKS, check_*, DB
  schema — untouched. env_file optional so a missing .env.watchdog never breaks
  `docker compose up` for the prod orchestrator.

Tests: tests/watchdog/ (TC-01…TC-13) + full tests/ regression green (TC-14).
Docs: CHANGELOG, .env.example canon (WATCHDOG_*); architecture README + adr-0033
authored at the architecture stage.

Refs: ORCH-100

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.yml

@@ -38,6 +38,39 @@ services:
     group_add:
       - "999"
 
+  # ORCH-100 (FND/F1b): sidecar-watchdog — the monitoring brain in a SEPARATE
+  # container (observer separated from observed, ADR-001 D2). Deploying it builds
+  # ONLY this service — the prod `orchestrator` is NOT rebuilt/restarted.
+  #   * network_mode: host -> /metrics reachable at http://127.0.0.1:8500/metrics
+  #     and host interfaces visible for memory/disk reads.
+  #   * docker.sock mounted :ro AND the code is GET-only (double read-only guard).
+  #   * host disk paths bind-mounted :ro so shutil.disk_usage sees the host FS but
+  #     can never write (opt-in disk ceiling, D6).
+  #   * mem_limit caps the thin stdlib daemon (D2): OOM = early "sidecar grew" signal.
+  #   * WATCHDOG_ENABLED=false (or simply not starting the service) -> inert.
+  orchestrator-watchdog:
+    build:
+      context: .
+      dockerfile: watchdog/Dockerfile
+    container_name: orchestrator-watchdog
+    restart: unless-stopped
+    init: true
+    network_mode: host
+    mem_limit: 128m
+    mem_reservation: 32m
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - /home/slin/repos:/repos:ro
+      - ./data:/app/data:ro
+    # Optional env_file (required: false): a missing .env.watchdog must NOT fail
+    # `docker compose up` for the prod orchestrator (self-hosting safety). Absent
+    # file -> WATCHDOG_* defaults, no token -> fail-safe (logs, does not send).
+    env_file:
+      - path: .env.watchdog
+        required: false
+    group_add:
+      - "999"
+
   # ORCH-31: staging instance (port 8501, isolated DB).
   # Starts ONLY with: docker compose --profile staging up -d orchestrator-staging
   # Normal "docker compose up -d" does NOT start this service.