refactor(bus): extract publish_safely + extend topics for DEBT-031

Shared publish_safely helper at decnet/bus/publish.py so the nine
workers about to be wired into the bus don't each copy-paste the
"never raise back at the caller" contract. Mutator drops its private
copy and imports the canonical one.

topics.py gains the attacker.* hierarchy (observed, scored,
session.started, session.ended) and a system_health(worker) builder
for per-worker health heartbeats — both prerequisites for the worker
rollout under DEBT-031.

decnet/mutator/engine.py

@@ -25,32 +25,13 @@ import contextlib
 from decnet.bus import topics as _topics
 from decnet.bus.base import BaseBus
 from decnet.bus.factory import get_bus
+from decnet.bus.publish import publish_safely as _publish_safely
 from decnet.web.db.repository import BaseRepository
 
 log = get_logger("mutator")
 console = Console()
 
 
-async def _publish_safely(
-    bus: BaseBus | None,
-    topic: str,
-    payload: dict,
-    event_type: str = "",
-) -> None:
-    """Fire-and-forget bus publish.
-
-    A bus failure must never break the reconciler — the DB write already
-    happened before we got here, so losing the notification is at most a
-    few seconds of UI latency (the next poll tick picks it up).
-    """
-    if bus is None:
-        return
-    try:
-        await bus.publish(topic, payload, event_type=event_type)
-    except Exception as exc:  # noqa: BLE001
-        log.warning("bus publish failed topic=%s: %s", topic, exc)
-
-
 @_traced("mutator.mutate_decky")
 async def mutate_decky(decky_name: str, repo: BaseRepository) -> bool:
     """