fix(diagnostics): bound outage once per batch

[rldyourmnd]

Summary

• stop a diagnostic batch after the first shared remote-HEAD outage
• preserve every remaining bundle in WAL for the next systemd retry
• bound outage time independently of backlog size

Verification

• make verify
• git diff --check
• a three-bundle test proves exactly one four-round remote probe and one failed bundle count