fix(zulip-monitor): Abiba leg reads nested zulip.connected; probe failures never restart

The monitor's Abiba leg parsed the :9200/health payload at the top level
(d.get('connected',False)) while the pi Zulip extension serves connection
state NESTED at zulip.connected / zulip.last_error (verified against the
extension's startHealthServer handler and the live endpoint). PI_CONNECTED
was therefore always False and every run took the DISCONNECTED path,
restarting a healthy bot: pm2 restarts=8 with the process created
2026-09-09T09:35:09Z, four ❌ Abiba verdicts today (04:23/05:35/06:55/09:35
UTC) and zero ✅, while the Zulip server answered HTTP 200 and the bot kept
heartbeating. The watchdog was the fault, not the connection.

Changes (Abiba leg only; every other leg byte-identical):
- Read the real nested shape: zulip.connected, zulip.last_error and
  zulip.messages_processed. The old retry_count branch is DROPPED — the
  payload exposes no retry counter (the extension keeps retryCount internal
  and never serialises it), so the branch is fabricated and cannot stay.
- Fail-safe restart decision: a fetch error (HTTP 000), non-2xx response,
  empty/unparseable body, or payload missing a boolean zulip.connected is a
  clearly-labelled PROBE FAILURE (🟠 alert + ⚠️ log line naming reason and
  HTTP code) and NEVER calls pm2 restart. pm2 restart runs only on
  affirmative zulip.connected=false (🔴/❌ path unchanged in wording).
  connected=true with last_error keeps the degraded 🟡 warn-no-restart path.

Regression test (new tests/zulip-monitor-abiba.sh, 36 checks): extracts the
real Abiba leg from between the # -- abiba-leg-start/-end markers in the
shipped script and executes it verbatim with stubbed curl/notify/pm2 against
fixtures of the real payload shape — asserts connected=true → no restart,
connected=false → restart, and empty/garbage/missing-key/non-boolean/HTTP
000/HTTP 500 bodies → probe-failure alert with zero restarts. The suite
fails loudly on the pre-fix base and on a marker-intact top-level-parse
variant, so this class of bug cannot return silently.

tests/fixtures/zulip-health-connected.json

@@ -0,0 +1,25 @@
+{
+    "status": "ok",
+    "platform": "pi",
+    "agent": "abiba",
+    "zulip": {
+        "connected": true,
+        "site": "https://chat.sysloggh.net",
+        "email": "abiba-bot@chat.sysloggh.net",
+        "queue_id": "ee7f8b6d-9d53-48a7-ad58-f6e999771001",
+        "bot_user_id": 21,
+        "messages_processed": 0,
+        "skipped": 0,
+        "last_error": null
+    },
+    "circuit_breaker": {
+        "state": "CLOSED",
+        "failures": 0,
+        "successes": 5,
+        "totalRequests": 5,
+        "failureRate": "0.000",
+        "openedAt": null
+    },
+    "workers": [],
+    "worker_count": 0
+}

tests/fixtures/zulip-health-disconnected.json

@@ -0,0 +1,25 @@
+{
+    "status": "down",
+    "platform": "pi",
+    "agent": "abiba",
+    "zulip": {
+        "connected": false,
+        "site": "https://chat.sysloggh.net",
+        "email": "abiba-bot@chat.sysloggh.net",
+        "queue_id": null,
+        "bot_user_id": null,
+        "messages_processed": 0,
+        "skipped": 0,
+        "last_error": "Zulip API error 401: queue registration failed"
+    },
+    "circuit_breaker": {
+        "state": "CLOSED",
+        "failures": 0,
+        "successes": 0,
+        "totalRequests": 0,
+        "failureRate": "0.000",
+        "openedAt": null
+    },
+    "workers": [],
+    "worker_count": 0
+}