Root supervisor for a BB robot.

Builds a supervision tree that mirrors the robot topology for fault isolation. A crash in an actuator at the end of a limb only affects that limb's subtree.

Supervision Tree Structure

BB.Supervisor (root, :one_for_one)
├── Registry (named {MyRobot, :registry})
├── PubSub Registry (named {MyRobot, :pubsub})
├── Task.Supervisor (for general async tasks)
├── DynamicSupervisor (for command GenServers, temporary restart)
├── Runtime (robot state, state machine, command execution)
├── BB.BridgeSupervisor (:one_for_one)
│   └── MavlinkBridge, PhoenixBridge...
└── BB.TopologySupervisor (:one_for_one)
    ├── BB.SensorSupervisor (:one_for_one)
    │   └── RobotSensor1, RobotSensor2...
    ├── BB.ControllerSupervisor (:one_for_one)
    │   └── Controller1, Controller2...
    └── BB.LinkSupervisor(:base_link, :one_for_one)
        ├── LinkSensor (link sensors)
        └── BB.JointSupervisor(:shoulder, :one_for_one)
            ├── JointSensor
            ├── JointActuator
            └── BB.LinkSupervisor(:arm, :one_for_one)
                └── ...

Each subsystem supervisor (sensors, controllers, bridges) has its own restart budget, so a flapping process in one won't exhaust the root supervisor's budget and bring down the entire robot. The topology supervisor groups all hardware-facing subtrees so they share a restart budget; when that budget is exhausted the safety controller force-disarms the robot.

Losing the hardware is not a reason to keep trying

The topology supervisor is :transient, so exhausting its budget stops it for good rather than starting another round. Hardware that has gone away — a servo bus losing power, a cable pulled — does not come back because a supervisor asked a second time, and retrying only spends the root's budget until the root dies too. Losing the root is worse than losing the topology: it takes the registries, the runtime and the robot's registration with BB.Safety.Controller with it, and with them any record that the robot faulted at all.

Stopping instead leaves the root standing, so the robot stays registered and the :error the safety controller latches on the way down survives to be read. The arm is gone; the robot still knows it had one. Recovery is deliberate — Supervisor.restart_child(robot_module, BB.TopologySupervisor) once the operator has acknowledged the fault, which is also what re-arms the monitor for next time.