fix(engine): the safe branch outlives the api (gh-#791, gh-#771)

[genwave-radio]

🔁 What

The engine's safe resolver no longer falls silent when the api stalls or goes away.

• ⏱️ Fetch bounded: curl --connect-timeout 2 --max-time 5 (engine: the safe-track curl has no timeout — a stalled API wedges safe rotation #771).
• 🧠 Up to 16 distinct safe answers remembered in engine memory; any fetch failure replays them round-robin (Engine goes silent about a minute into an api outage: the safe branch starves without /internal/safe-track #791).
• 🧹 A 204 (empty safe scope) forgets everything, so an emptied scope still means silence.
• 🔥 Background warmer: 30 s until full or 20 warms, then 300 s.
• 📝 One log line per outcome (timed out / unreachable / HTTP error / failed / empty).
• ⚠️ Accepted: during an outage a track removed from the safe scope may replay (≤ 16, outage-only).

✅ Proof

• Gh791_SafeResolverSurvivesApiOutage: 12/12. It runs the shipped resolver block in real Liquidsoap 2.4.5, and runs the real curl line in the engine image against a stub api, a stalled api (cut off within 5 s, then replay) and a missing host.
• Live dev stack: api stopped for 8 min. After the queue drained, the log shows 13× unreachable (curl 6); replaying remembered safe track, zero final-guard lines, and the engine returned to the main feed after restart.
• Full solution suite: green except 3 Story324 espeak-ng specs (no espeak-ng on the dev box; nightly installs it). Engine byte pins re-pinned. Build: 0 warnings, 0 errors.

🔜 Not here

The gate's F178.8(a) move back to zero silence (GW_SAFE_GAP_SECONDS=0 in the gate compose, retire GATE_OUTAGE_SILENCE_MAX_SECS) is a follow-up.

Closes #791
Closes #771