pet-life: the permadeath mechanic, persistence and the cemetery #17

The library and one-shot behind the menu-bar face. See docs/superpowers/specs/2026-09-04-menubar-pet-design.md.

Done when:

• Stages derive from time since last activity: content, restless, hungry, sick, dying, dead at 7 days. Thresholds are constants.
• Death occurs at last_activity + 7 days, not when observed, so the answer is identical whenever you look.
• A new pet is born on the next activity after a death, never automatically — a fortnight away must yield one grave, not a chain of pets that were born, never fed, and died.
• Names are deterministic from the birth timestamp, drawn from a fixed list.
• The cemetery records every pet and is not capped.
• State lives at $XDG_DATA_HOME/ambient-companions/pet.json, not under the daemon's runtime-derived state directory, and is written temp-file-plus-rename.
• Activity is the later of the history's last_activity_ms and the highest value ever persisted, so a closed app does not starve a pet.
• The JSON contract is pinned to exact bytes.