fix(audit-2026-04-29): throttle gh-actions-ticker 60s→600s + harden /data symlink recreation

Audit findings:
1. gh-actions-ticker @ 60s burst piled 200 jobs vs free-tier 20-concurrent
cap → 17h queue depth, 0 completions. Throttle 600s lets queue drain.
2. /data/logs daemon writes failing Errno 5 I/O (stale symlink). Defensively
mkdir + recreate symlink on each boot. Add marker probe to log fatal
when persistent mount truly broken.

bin/gh-actions-ticker.sh

@@ -17,9 +17,10 @@ set -uo pipefail
 LOG="$HOME/.surrogate/logs/gh-actions-ticker.log"
 mkdir -p "$(dirname "$LOG")"
 
-TICK_SEC="${GH_TICK_SEC:-60}"    # MAX BURST: 60s. 5-dataset cap unlocked
-                                  # 640 commits/hr aggregate, retry-backoff
-                                  # absorbs anything above. Pedal to floor.
+TICK_SEC="${GH_TICK_SEC:-600}"   # Throttled 60s→600s (audit 2026-04-29):
+                                  # 60s burst piled 200 jobs vs free-tier 20-concurrent
+                                  # cap, 17h queue depth, zero completions. 600s lets
+                                  # the queue actually drain. Override via GH_TICK_SEC.
 
 dispatch() {
     local repo="$1"

start.sh

@@ -39,10 +39,21 @@ if [[ -d "$DATA" ]] && [[ -w "$DATA" ]]; then
         target="${spec%%:*}"
         link="${spec##*:}"
         mkdir -p "$(dirname "$target")"
-        if [[ ! -L "$target" ]]; then
+        # Always ensure backing directory exists + writable. If the persistent
+        # /data mount becomes unavailable mid-run, daemon writes to symlinked
+        # path fail with Errno 5 I/O error (audit 2026-04-29). Recreating the
+        # link defensively each boot fixes stale-symlink cases.
+        mkdir -p "$link" 2>/dev/null || true
+        if [[ ! -L "$target" ]] || [[ ! -d "$target/" ]]; then
+            # Either not-a-symlink OR broken symlink (target unreachable)
             rm -rf "$target" 2>/dev/null
             ln -sfn "$link" "$target"
         fi
+        # Final sanity probe — write a marker; if it fails, the persistent
+        # mount is broken regardless of the symlink, so log loudly.
+        if ! touch "$target/.boot-marker" 2>/dev/null; then
+            echo "[$(date +%H:%M:%S)] ⚠ FATAL: $target/ not writable — daemon log writes will Errno 5"
+        fi
     done
 
     # training-pairs.jsonl — single file persistence