feat(machine): add renderer watchdog for kiosk resilience

After 6 days of uptime the Electron renderer silently crashed while the
main process kept running (blank screen, no recovery). Three-layer
detection: render-process-gone (instant), unresponsive (Chromium), and
IPC heartbeat (30s ping, 2 missed = reload). Reloads renderer via
loadFile/loadURL preserving HAL hardware state in main process.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/machine/electron/preload.ts

@@ -86,6 +86,12 @@ contextBridge.exposeInMainWorld('electronAPI', {
     ipcRenderer.on('hal:error', (_event, error) => callback(error))
   },
 
+  // Watchdog heartbeat (main process → renderer → main process)
+  onWatchdogPing: (callback: () => void) => {
+    ipcRenderer.on('watchdog:ping', () => callback())
+  },
+  watchdogPong: (): Promise<void> => ipcRenderer.invoke('watchdog:pong'),
+
   // Platform info
   platform: process.platform,
 })
@@ -126,6 +132,8 @@ declare global {
       onHalBillInserted: (callback: (denomination: number) => void) => void
       onHalBillRejected: (callback: (reason: string) => void) => void
       onHalError: (callback: (error: string) => void) => void
+      onWatchdogPing: (callback: () => void) => void
+      watchdogPong: () => Promise<void>
       platform: NodeJS.Platform
     }
   }