Directive 1: voice intake watchdog (layer attribution, daily repeat, Apprise)

Build the Hub Fixes Directive 1 watchdog as a small standalone service on .13.

- Watch voice/audio_stream (paho); 15 min silence = 3 missed heartbeats.
- Attribute failures in order: broker -> voice_bridge -> ESP32/no-publisher.
  The ESP32 is never blamed when the broker or the bridge broke.
- Alert via Apprise on .35:8210 (tag sam_ntfy; daily repeat escalates to sam).
- Persist state; repeat once a day while broken; recovery notice; alerts stop.
- No auto-heal of any kind. Notification only.
- Require publisher evidence (heartbeat or retained presence) before treating
  silence as a failure, so the unflashed Directive 3 firmware cannot cause the
  cry-wolf false alarms the spec warns about.
- Docker: host network, read-only Docker socket, state volume, unless-stopped.
- 23 unit tests; live evidence captured in watchdog/README.md.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

watchdog/docker-compose.yml

@@ -0,0 +1,43 @@
+# voice intake watchdog — Hub Fixes Directive 1
+#
+# Network mode host: the watchdog must reach the .13 broker on localhost:1883
+# and the Apprise API on 192.168.20.35:8210. No new listening port is opened.
+#
+# The Docker socket is mounted read-only so the watchdog can check whether the
+# `voice_bridge` container is running and subscribed. It never writes to it.
+#
+# Bring it up with ./start_watchdog.sh (sources the lab secrets first) or:
+#   DRY_RUN=1 docker compose up -d --build   # no real notifications
+
+services:
+  voice-intake-watchdog:
+    build: .
+    image: voice_intake_watchdog:local
+    container_name: voice_intake_watchdog
+    restart: unless-stopped
+    network_mode: host
+    environment:
+      - MQTT_HOST=192.168.20.13
+      - MQTT_PORT=1883
+      - MQTT_USER
+      - MQTT_PASS
+      - AUDIO_TOPIC=voice/audio_stream
+      - STATUS_TOPIC=voice/status
+      - SILENCE_TIMEOUT_SECONDS=${SILENCE_TIMEOUT_SECONDS:-900}
+      - CHECK_INTERVAL_SECONDS=${CHECK_INTERVAL_SECONDS:-30}
+      - REPEAT_INTERVAL_SECONDS=${REPEAT_INTERVAL_SECONDS:-86400}
+      - APPRISE_NOTIFY_URL=http://192.168.20.35:8210/notify/apprise/
+      - APPRISE_TAG=sam_ntfy
+      - APPRISE_TAG_REPEAT=sam
+      - BRIDGE_CONTAINER=voice_bridge
+      - DOCKER_SOCKET=/var/run/docker.sock
+      - STATE_FILE=/var/lib/voice_intake_watchdog/state.json
+      - DRY_RUN=${DRY_RUN:-0}
+      - REQUIRE_PUBLISHER_EVIDENCE=${REQUIRE_PUBLISHER_EVIDENCE:-1}
+      - LOG_LEVEL=${LOG_LEVEL:-INFO}
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - watchdog_state:/var/lib/voice_intake_watchdog
+
+volumes:
+  watchdog_state: