Harden heartbeat: live PR verification before trusting active-ci-watch.env

Modify the heartbeat so that when active-ci-watch.env contains PR_NUMBER, it runs `gh pr view $PR_NUMBER` and reconciles live state (state, reviewDecision, mergeStateStatus, headRefOid, commits last edge status) against the cached env values. If they differ, refresh the env file and re-evaluate NEXT_RECHECK / DM logic. Then add a self-test using a scratch env file to confirm drift is detected. Subtask of the recurring CI-watch trust issue identified in 2026-08-27/28/29/30/31 and 2026-09-01/02 reflections.