Top-level supervisor for hecate-om.

Owns four workers and one nested supervisor, all shared by the hosting service: 1. hecate_om_identity — keeps the realm cert + UCAN cached 2. hecate_om_capabilities — fans capability advertisements out 3. hecate_om_pubsub_sup — dynamic supervisor of this service's macula_subscriber children (piece D) 4. hecate_om_pubsub_subscriptions — reconciles the desired subscription set against (3)'s actual running children 5. hecate_om_health — bookkeeping for /health responses

and, when health_port is configured, the Cowboy listener that actually serves GET /health on it (so Podman's HEALTHCHECK and k8s liveness probes have something to hit).

When station seeds are configured, also the mesh pool itself (piece A, PLAN_HECATE_OM_MESH_WRAPPERS.md): an ordinary restart => permanent child wrapping macula_client:connect/2 (via hecate_om_identity:start_mesh_pool/0, which needs this gen_server's already-loaded keypair — hence positioned right after it). A pool crash is no longer this app's problem to notice and react to; OTP just restarts the child, same as any other. With no seeds configured the child is omitted entirely — same health_ listener/0 pattern as the HTTP listener below — so hecate_om_identity:macula_client/0 degrades to {error, no_client} exactly as it did before this piece, not a harmlessly-idle pool masking "nothing configured" as "connected".