What changed

Reduce the chance of a secondary crash when the app's main thread hits the rare foreground-service startup timing error. The historical safety net that swallows the first such error stays — but it can no longer add another crash on top while logging or reporting.

Technical Context

• The pasted ANR shows Android's own pre-handler (RuntimeInit.logUncaught) blowing up inside StringBuilder.append while serializing the exception. That platform path runs before our default handler — we cannot prevent it. We can only ensure our suppression path doesn't add to the problem.
• Extracted the handler into CapodUncaughtExceptionHandler with seams (main-thread provider, looper invoker, reporter callback, exit) so the suppression / delegation / repeat logic is unit-testable.
• Wrapped Bugs.report() logging and reporter notification in runCatching — a hostile throwable's toString()/message or a failing reporter no longer escapes.
• Logging.logInternal now isolates per-logger failures (a broken logger can't take down the rest), and Throwable.asLog() falls back to a class-name + safe-message summary if printStackTrace itself throws.
• One-shot suppression is preserved: the second timing exception delegates to the previous handler as before.