Follow-ups from #920: re-arm the inbox watcher after an error, pin the fix on a real Linux watcher #922

Follow-ups from the review of #920 (non-blocking), tracked here as one issue.

Watcher recovery (plugins/openclaw-tps-mail/src/index.ts)

1. After a watcher error, that inbox stays on the 30 s rescan for the rest of the process's life, announced once. Re-arm the watcher from the rescan tick, bounded (for example at most once per tick, with backoff on repeated failures), so a transient failure recovers within one rescan interval. A re-arm inside the error handler itself is not the shape: it can spin against a path that still fails.
2. The new warn line interpolates err?.message, which can carry a path under new/ whose filename the writer chose. This matches the plugin's existing warn lines; decide whether the plugin's log lines should pass through one sanitiser.

Tests
3. new-dir-rescan's watcher-error case does not prove the message arrived through the rescan rather than the stub watcher's listener. Suppress the stub's events after the error, or assert the rescan's promotion log line.
4. verify-strict's afterEach closed-watcher check passes with zero watchers; also assert the watch stub was called.
5. Add a Linux-lane check against the real, unstubbed fs.watch(dir) that the plugin attaches its error listener (listenerCount("error") === 1), so the fix itself is pinned in CI, not only the stubbed behaviour.
6. Confirm the test comment "Reason: is the last line" against every writer of the dead-letter reason file, and that the fixture filename stamp (2026-05-26…) is not subject to any age gate in the plugin.

Refs #720, #920.