fix(core): the cleanup reaper finishes its run when one action fails

[V3RON]

Closes #659

Status

Implement: done (14/14 reaper file, 1222/1222 src/core, 4379/4379 pnpm test:changed; probes 2/2) Review: round 1, 0 blocking, 0 fixed unreviewed, 0 notes Hardware: n/a Gate: merged (7bbc22e)
Next: none

Done when

• One action that throws inside the reaper's loop is contained, logged, and the run continues, so every proposal after a device whose platform has no driver is still executed, for both the idle-shutdown and the idle-destroy verb — the carried repro (src/core/reaper.test.ts, both verbs in one run)
• A run-level failure (a rule or the registry view that throws) still rejects the run — "A cleanup run that throws logs at error." and "a cleanup run that throws is logged once, however many triggers joined it"
• The fix adds no third hasDriver filter and duplicates no skip predicate — the catch is at execute; nothing was added to #view()

Probes run on the final head, each reverted after:

• Revert (the bare await restored): the repro reds on its own named assertion — promise rejected "NoDriverError: No driver registered for platform: android" … at CleanupReaper.#runOnce, and the log test reds on its resolve assertion.
• Over-catch (the catch widened around the whole pass): both run-level tests above red on their log assertions, so they are live and the catch sits at execute, not around the pass.

New path and its test (strict area): the catch adds one path, the cleanup action failed line, proven by "logs a cleanup action that throws at error, naming the action, rule and target, and still resolves the run". The repro covers the continue side for both verbs.

Assumptions

• Assumption: exit status of simlock cleanup with a failed action — it now exits 0 with the failure only in an error log; this follows from the fault isolation the triage chose and no doc says otherwise. docs/CLI.md's cleanup section and its exit-code table name no failure for a command whose run completes, NO_DRIVER (12) stays true of the commands that still surface it, and no e2e or client test pins a throwing cleanup.run.

For #660: NukeService.#runNuke has the same loop with the same missing catch; the shape here (catch at execute, log, continue) factors to it, but its spec decides its own fix and this PR does not touch it.

Review

Spec review: 0 blocking, 0 fixed, 0 notes. Code review: 0 blocking, 0 fixed, 0 notes. Claims review: 0 blocking, 0 fixed, 0 notes.
Rounds: 1. Tokens: n/a.

Nothing was rejected, so nothing is listed. Round 1 confirmed no src finding, so round 2 and the fix check did not run (rule 14).

Kind full, so all three reviews ran; the code reviewer with lens: both in its own worktree of cffd92ee. Inputs came from .agents/scripts/review-inputs.sh 664 (rules, ADRs and briefs from main).

How the reviews were spawned: this session sits at subagent depth and the harness refused nested spawns, as on #643, #644, #646, #649, #650 and #661. Each reviewer ran as a fresh detached claude -p session — the body of .claude/agents/<reviewer>.md as its system prompt, its model from that file's frontmatter — reading only the inputs directory and its own worktree of the reviewed commit, with no PR body, commit messages or another reviewer's output; each read .agents/briefs/calibration.md first. Nothing was reviewed by the agent that wrote the code.

Written by an agent.