boot: a WAL read that never settles leaves a permanently blank app

Pre-existing (from #162), found during an adversarial review of #189.

If `readWal()` never settles, `hydrationState` stays `"pending"` and `AppBody`
renders `null` forever. `BootFailedScreen` is only reached on **rejection**, so
a hang has no reload affordance at all: the pilot gets a black screen and no way
out.

Reproduced by accident with a bad patch while testing the boot gate under a
stalled IndexedDB transaction.

Safe from the data-loss angle — nothing can clear the WAL in that state, so the
flight survives — but it is indistinguishable to a pilot from the black screen
of #185, and the recovery (force-quit) is the one thing that looks most like
data loss even when it is not.

Worth pairing with #188: the boot gate is upstream of any React error boundary,
so the boundary cannot cover this. A timeout that falls through to
`BootFailedScreen` would.