manager: restart self-crashed processes (backport of commaai/openpilot#36755)

[PeterPhuTran]

Description

A managed process that dies on its own while its should_run predicate stays true
is never restarted:

• stop() — the only place that logs the death and clears self.proc — is only
  reached when should_run flips false
• start() early-returns whenever self.proc is set, even for a dead child
• check_watchdog() only covers processes with watchdog_max_dt

So the process stays down for the rest of the onroad session while managerState
reports shouldBeRunning=True / running=False, and selfdrived raises
processNotRunning (NO_ENTRY + SOFT_DISABLE) permanently — engagement blocked
and force-disengaged until the car is restarted.

Observed live during the #309 investigation: loggerd SIGABRTed 3 seconds after
starting (NVMe failure) and stayed dead the whole session — alert on screen, no
restart, no death log, RouteCount frozen.

Fix: backport of commaai#36755 — an opt-in restart_if_crash flag on
ManagerProcess plus a reap in ensure_running() (verbatim upstream logic),
preserving FrogPilot's watchdog machinery and should_run signature. Unlike
upstream, the flag is also plumbed through NativeProcess, since FrogPilot's
crash-relevant targets (loggerd/encoderd/TICI ui) are native.

Flagged processes: ui (mirrors upstream's only flagged process), plus loggerd
and encoderd (per #309 — a logging-process crash must not permanently block
engagement).

Known tradeoff (accepted upstream in commaai#36755): a flagged process that crash-loops is
restarted once per manager loop pass. Opt-in, limited to these processes.

Verification

New test_restart_if_crash in system/manager/test/test_manager.py:

• flagged process gets reaped and restarted with a new pid
• unflagged process keeps opt-in semantics (stays dead)
• fails on the unpatched base, passes with the fix; verified on-device
  (comma three, including a -W error run matching CI's -Werror)

🤖 Generated with Claude Code

[github-actions]

Thanks for contributing! A maintainer will review your pull request soon.

[PeterPhuTran]

Pushed one more flag: logmessaged — justified by a live incident on the same device today. updated logged a 130KB git diff output record for a dirty working tree; logmessaged crashed publishing it to the 256KB logMessage msgq (msgq asserts 3*msg_size <= queue_size, so anything over ~85KB is fatal, while logmessaged's own guard only rejects >2MB). Being unflagged, it stayed dead for the rest of the session — permanent "Process Not Running: logmessaged" and total swaglog loss. The crash of the logging daemon is the one crash it can never log, which makes it exactly the kind of always-run, non-safety process this flag exists for. (The guard/queue-size mismatch is a separate bug — happy to PR that fix too.)