feat(log): crash-survivable FileLogSink + dev/prod verbosity toggle (T-432)

First increment of the observability epic (T-425), the productive pivot after
the ConPTY freeze refused to reproduce on CI: if we can't reproduce it, make
the next occurrence leave evidence.

- FileLogSink (lib/kernel/src/file_log_sink.dart): synchronous, crash-survivable
  LogSink. Appends each record as one JSON line to a size-rotated file; fsyncs
  warn/error + risky-source (pty/ffi/conpty/watchdog) records immediately so the
  last breadcrumb is on disk before a hard death, batches the rest on a timer.
  Never throws. Flutter-free → unit-tested under dart test against a temp dir.
- logDirectory() (paths.dart): persistent per-platform log dir (LOCALAPPDATA /
  ~/Library/Logs / $XDG_STATE_HOME) — durable across reboot, unlike the
  ephemeral socketDirectory.
- resolveLogLevel() (log.dart): the requested dev/prod toggle. CLIDE_LOG
  dart-define → CLIDE_LOG env → app.log.level setting → warn(release)/info(debug).
  Lenient parse; an invalid source falls through.
- Boot wiring (facade.boot + main.dart): FileLogSink leads the sink chain (so a
  crash records before the volatile stderr/ring sinks) and the resolved level
  sets Logger.minLevel.

Tests: FileLogSink (JSON shape, error/stack, rotation cap, append-across-restart,
timer-cancel), resolveLogLevel precedence + fall-through, logDirectory per-OS.
Coverage gate 95.11%.

Follow-ups under T-425: live toggle CLI/command/chip (T-433), FFI breadcrumbs
(T-434), watchdog isolate (T-435), CI artifact wiring (T-436).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/src/ipc/paths.dart

@@ -54,6 +54,32 @@ String socketDirectory() {
   return '$base/clide';
 }
 
+/// Persistent per-platform directory for crash-survivable logs (T-425).
+///
+///   Linux:   `$XDG_STATE_HOME/clide/logs` (else `$HOME/.local/state/...`)
+///   macOS:   `$HOME/Library/Logs/clide`
+///   Windows: `%LOCALAPPDATA%\clide\logs`
+///
+/// Unlike [socketDirectory] — which intentionally lives in an EPHEMERAL
+/// runtime dir (`$XDG_RUNTIME_DIR`, `~/Library/Caches`) that the OS may wipe
+/// on logout/reboot — this is a DURABLE location. The whole point of the
+/// FileLogSink is that a freeze's last breadcrumbs survive the power-cycle, so
+/// the log dir must outlive a reboot.
+String logDirectory() {
+  if (Platform.isWindows) {
+    final local = Platform.environment['LOCALAPPDATA'];
+    final base = (local != null && local.isNotEmpty) ? local : '${Platform.environment['USERPROFILE'] ?? r'C:\'}\\AppData\\Local';
+    return '$base\\clide\\logs';
+  }
+  if (Platform.isMacOS) {
+    final home = Platform.environment['HOME'] ?? '/tmp';
+    return '$home/Library/Logs/clide';
+  }
+  final state = Platform.environment['XDG_STATE_HOME'];
+  final base = (state != null && state.isNotEmpty) ? state : '${Platform.environment['HOME'] ?? '/tmp'}/.local/state';
+  return '$base/clide/logs';
+}
+
 /// FNV-1a 64-bit hash of [s] as a 16-char lower-case hex string.
 /// The C client (T-126) reproduces the same algorithm byte-for-byte
 /// so server + client always agree on socket path. Not cryptographic