- Cap each subscription's pending queue at MAX_PENDING (50) so a channel that can
no longer receive messages cannot grow state.json without limit. prune_pending
also runs after appending, so a single poll cannot push the queue past the limit.
- Log the actual error from refresh() and deliver() in the poll loop and from the
framework on_error handler; both discarded it, leaving a stalled refresh with no
diagnosable cause.
- Handle SIGTERM as well as Ctrl+C so container runtimes can stop the bot between
commits instead of killing it mid-write.
Adds regression tests for the queue bound in both prune_pending and updated().
