[madeofpendletonwool]

Implements MAD-806 — the box notices it's stuck and fixes itself, without anyone walking over to it.

• systemd arms the hardware watchdog (RuntimeWatchdogSec=15s): a kernel or systemd hang hard-resets the Pi; the read-only root brings it back clean
• Kiosk watchdog in boxd: page heartbeat stalls 90 s while the server answers /healthz → restart the kiosk; 3 watchdog restarts in 15 min → reboot instead; server-unreachable stays the offline screen's job (no restart loops); the storage-lost screen never feeds it
• Nightly kiosk reload around 05:00 local, only while the page is up and idle (never while playing) so a long-lived Chromium gives its memory back
• Thermals: boxd logs vcgencmd temp + throttle flags to the journal every minute and reports them in /v1/info for stage 4 (get_throttled bit layout pinned by tests)
• systemd-timesyncd enabled and ordered before the kiosk (time-sync.target) — the server's playback clock sync trusts the browser's clock and a Pi has no RTC battery by default
• README recommends a heatsink/fan case; the done-when hardware procedures (kill -STOP renderer, sysrq crash, 12-hour visualizer soak, Pi 4 + Pi 5) are in docs/testing.md; CI smoke test extended

Full suite passes locally (make lint, make test: 58 bats + go). Image build + smoke run in CI.