warmboot: heal fully-down duo when stack is idle

Stack restart after the sidecar's boot pass left duo_up=0 and the heal
branch (which required exactly one member) never fired. Heal now also
triggers when zero duo members run AND the running list is empty, so a
bounced stack repopulates automatically. A deliberate swap to a non-duo
model still isn't fought (running list non-empty).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/duo-warmboot-daemon.sh

@@ -58,7 +58,13 @@ while true; do
       *) duo_down="$duo_down $model" ;;
     esac
   done
-  if [ "$duo_up" = "1" ]; then
+  # heal when the duo is partially down (crash) or fully gone with the stack
+  # idle (stack restarted after our boot pass). Never fight a deliberate
+  # swap: if a non-duo model is active, running is non-empty with duo_up=0.
+  heal=0
+  if [ "$duo_up" = "1" ]; then heal=1; fi
+  if [ "$duo_up" = "0" ] && [ "$(printf %s "$running" | grep -c '"model"')" = "0" ]; then heal=1; fi
+  if [ "$heal" = "1" ]; then
     for model in $duo_down; do
       echo "warmboot: healing $model (crashed?) $(date '+%H:%M:%S')"
       if curl -sf --max-time 900 "$BASE/upstream/$model/health" >/dev/null 2>&1; then