applog-pull zero-row path skips writeWatermark — permanent cold-start gap

scripts/applog-pull.ts:460-463 returns before writeWatermark on zero fresh rows; the freshRows.length===0 branch at line 469 already advances watermark on successful-but-nothing-to-send runs, so the zero-row branch is the inconsistent one. Effect: any instance whose first N runs return zero error/warn rows never gets a watermark written, so its lookback window stays a permanently rolling 24h — any pre-existing backlog older than 24h at first-successful-classification time is silently unalertable forever (measured live on terra: 10 rows stuck this way until manually flushed 2026-08-16). Not urgent now — terra+enamel both flushed/functioning. Real risk is future cold-start instances (new app onboarded, or a long pull outage before first successful run). Fix needs a nullable-cursor + scannedThrough field sourced from the DB's own now() in the zero-row query, not JS Date.now() (clock skew between venus and DB would silently skip boundary rows) — a real watermark-contract design change, not a fold-in patch.