fix(pulse): unblock the event loop, bound two child spawns, hoist the cron parse

[elhoim]

5 commits, one per fix, so each can be cherry-picked independently. Each was verified to apply cleanly onto 47df8ee by itself.

Commit	Fix
d3d7f20	stop hypotheses blocking the event loop
2ce4dc2	drain stderr and bound the atlas insights spawn
44815ef	parse the cron expression once per scan, not once per minute
c7dbe94	fail loud on an output target this build no longer handles
8d92c6b	stop the menubar rendering "NaNd" for a down sidecar

---

Five defects in the Pulse server modules. Two are regressions of bugs this same release fixed elsewhere.

• modules/hypotheses.ts:180 — execFileSync with a 120s timeout inside an HTTP handler blocks Bun's single-threaded event loop; /healthz, the dashboard and hook validation all stall behind it. Matches the async shape this release already applied to modules/bunker.ts.
• modules/atlas.ts:48 — stderr: "pipe" never drained and no timeout, so >64KB on stderr deadlocks the request and wedged children accumulate on every uncached poll. Matches the modules/work.ts fix from this same release: drain both streams concurrently under a kill timer.
• lib.ts:348 — mostRecentOccurrence re-parsed the cron expression on every one of up to 10,080 minute-steps. The parse, not the field test, was the whole cost. Hoisted out of the loop; matchesCron's public signature is unchanged.
• lib.ts:468 — telegram was removed from OutputTarget with no default: branch, so a config upgraded from an older version keeps those jobs, sends nothing, and still reports success. Now logs an error.
• modules/menubar.ts:352 — a clamped value was used for tsMs but the raw NaN reached agoFrom, rendering "Hermes sidecar down — NaNd". Clamps once and uses it for both.

modules/upgrades.ts is in the diff for one reason only: making graduateHypothesis async requires its caller to await. Not a drive-by.

---

Testing. Commands and output are in the per-file notes above. I did not do a fresh-system install verification (contributing step 3) — these are targeted fixes verified per-file, not an install run.