Closes #7.

Problem
The kanban dispatcher loop in `_kanban_dispatcher_watcher` can silently stop
cycling while the gateway process stays alive — observed twice in one day
(2026-06-07). Cause is unclear (possibly hung `dispatch_once()`, sqlite lock,
or event-loop livelock). Without instrumentation we can't tell a dead loop
from an idle gateway.

This unblocks investigation of #5 (HTTP 429 → delayed retry) and #6 (provider
auth crashes → skip-not-stall), both of which were blocked on "is the
dispatcher even running?" being answerable.

Solution
Write a heartbeat JSON to `$HERMES_HOME/state/dispatcher_health.json` at the
end of every dispatcher cycle (success AND exception paths AND cancellation).

Schema (v1, stable contract):
  schema_version: 1
  last_cycle_ts: float        # unix seconds, end of cycle
  last_cycle_iso: str         # UTC ISO 8601 with Z suffix
  cycle_started_at: float
  cycle_duration_seconds: float
  interval_seconds: float     # configured cadence (default 60)
  cycles_since_start: int     # monotonic; first cycle = 1, 0 means "never wrote"
  any_spawned_this_cycle: bool
  spawned_total_this_cycle: int   # count across all boards
  ready_pending: bool         # ready queue non-empty
  consecutive_bad_ticks: int  # mirrors the existing HEALTH_WINDOW counter
  gateway_pid: int
  cycle_error: str | null     # exception text if cycle errored

Detection rule for monitors:
  stall = time.time() - last_cycle_ts > 2 × interval_seconds
  dead  = last_cycle_ts > 5 minutes ago AND gateway PID still alive

Implementation
- New method `GatewayRunner._write_dispatcher_heartbeat` (gateway/run.py).
  Uses existing `atomic_json_write` for crash-safe writes.
- Called from `_kanban_dispatcher_watcher` at end of every iteration.
- Heartbeat-write failures are wrapped in try/except so they can NEVER
  kill the dispatcher (heartbeat is a diagnostic, not a dependency).
- Cancellation path also writes a final heartbeat with cycle_error="cancelled"
  before re-raising — so monitors can distinguish clean shutdown from crash.
- Locals (`cycles_since_start`, `any_spawned`, etc.) initialized at top of
  the loop body BEFORE any try block so they're defined for the heartbeat
  call even if zombie-reap or main tick throws.

Tests (5/5 passing)
- Schema-v1 contract pinned (all 13 keys, types, ISO Z suffix)
- Cycle-error path recorded correctly
- Two writes overwrite (not append)
- First-cycle-is-1 contract (monitors treat 0 as "never wrote")
- Auto-creates `state/` dir if missing

Follow-up (separate issues)
- Extend `hermes gateway status` to read this file and show stall age
- Schema v2: add `gateway_started_at` for uptime computation without ps
- Optional Prometheus textfile exposition for node_exporter setups

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>