fix: harden Herdr reconciliation and bootstrap retries

[codyde]

Closes recovery and setup gaps in #1176.

Changes

• Missed updates: refresh after subscription reconnects and every 30 seconds, so missed events don't leave Herdr out of sync.
• Stale state: send wake/sleep requests to the server even when the picker thinks they're unnecessary. Discard sync plans overtaken by another action, and protect an acknowledged sleep from stale RUNNING responses for up to 60 seconds.
• Account switching and overlapping commands: scope saved state to the account and backend; lock updates and write atomically to prevent incorrect profile removal or lost updates.
• SSH keys: configure Herdr to use the same key Railway used to check the connection.
• Incomplete setup: show New when there are no agents, return bootstrap failures as errors, and let Connect retry setup with the selected harness.

Validation

All 1,418 tests pass, including regression coverage for stale wake decisions, account switching, concurrent writes, and sleep during an SSH wait. SSH key selection was checked with OpenSSH. Formatting and Clippy pass, with existing warnings.

Still open

• Live create/sleep/wake and per-harness restoration need end-to-end testing.
• Automatic recovery from Herdr's Attention state needs upstream connection-status support.
• Locking covers one watcher session; cross-session coordination remains open.
• The watcher still uses the internal subscription API, with polling as a fallback.