fix(data-pump): self-heal main fetch loop on error and validate restart input

[jbiskur]

Summary

• Adds startMainLoop() that wraps loop() with .catch() + exponential 1s..30s backoff, mirroring the v0.19.1 startProcessLoop() self-heal pattern.
• mainLoopRestartAttempts counter resets on successful pull and in stop().
• restart() now synchronously validates state.timeBucket matches ^\d{14}$ — bad input throws at call-site instead of silently killing the pump later in the loop.
• Try/catch around the restartTo consumption at lines 349-358 so a poisoned restart state can't permanently crash the loop.

Why

The 2026-05-13 outage (data-pathways outage chain bddefdd2-c377-472a-bc50-cd75f708f822) had this exact failure mode: a CP regression sent ISO-format timeBucket: "2026-05-12T13:13" → pump.restart() → loop hit getClosestTimeBucket regex → threw → pump died silently → recovery required kubectl rollout restart. The v0.19.1 fix self-heals the processor loop but the same pattern was never applied to the main fetch loop.

Test plan

• deno fmt --check
• deno lint
• deno check src/mod.ts
• deno test -A test/tests/data-pump-restart.test.ts — 3 tests, 9 steps, all green
• deno test -A — 11 passed, 53 steps, 0 failed
• TDD discipline: pre-fix verification confirmed cases (a) (b) (d) (e) fail meaningfully against unfixed code

Test cases added

• (a) Loop throws once → self-restart succeeds, attempts counter resets
• (b) 7 successive failures → exp backoff sequence 1, 2, 4, 8, 16, 30, 30s
• (c) stop() during pending retry → no further retry
• (d) restart() with ISO timebucket → throws synchronously
• (e) Poisoned restartTo survives — loop catches inner throw, logs, exits cleanly
• (f) Happy-path regression

🤖 Generated with Claude Code