Fold the sentinel into the scraper and drop the sentinel service (BL-0046)

The stall watchdog now runs inside the scraper (ScraperService.checkStalls,
every 30 s from the work loop): same rule as before, one checkpoint-safe
restart, quarantine on the second stall, missing checkpoint is no evidence,
and paused time no longer counts. Stalls are recorded as scraper incidents
(failure.kind 'stall'). The private /api/recovery endpoint is gone.

Dropped with the service: reader/scraper-unreachable incidents (supervisor
and Docker handle crashes; the health page shows "Scraper: unreachable"),
duplicate job-failure incidents and the unused /metrics endpoint.
The stack is now reader + scraper (+ optional peer-gateway).
The supervisor test moved to runtime/test (npm run test:runtime stays).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/reading-limiter.md

@@ -16,7 +16,7 @@ hours**; that page is read-only.
 Set these deployment variables in the Compose `.env` file next to
 `docker-compose.yml`, then recreate **only the reader**. The `reader` service
 passes them through to the container. `READER_IMAGE` selects a reader-only
-release while `APP_IMAGE` continues to select the scraper and Sentinel image.
+release while `APP_IMAGE` continues to select the scraper image.
 Leaving `READING_WINDOWS_JSON` empty disables the limiter. Day keys
 are `0` Sunday through `6` Saturday. Each day has any number of `[start,end]`
 intervals; an end earlier than its start carries into the next day. `24:00` is