PLN asked for a restart-SC command in the tray menu. The reason it is worth
having: a headless sclang has no post window and no eval-over-OSC endpoint, so
a restart is the ONLY way to arm the sample-watcher responder or to pick up a
sample pack dropped since boot. Today that meant typing a systemctl line into a
terminal, mid-compose, which is exactly the friction the tray exists to remove.

The catch is that it sits two pixels under 'Launch Gig' and it is the only
entry in this menu that can STOP THE SOUND. So while the rig is up it is not a
one-click action: the first click arms it and says what it costs, and a second
click — which means opening the menu a second time, deliberately — fires. The
arming lapses after ten seconds. That is #116's rule ('the hot path cannot
start the sound by accident') applied to the opposite accident, and it is why
there is no confirmation DIALOG: a modal stealing focus mid-set is its own
hazard (#136). When the unit is DOWN there is nothing to interrupt, so it stays
a single click.

The label carries the state rather than the intent, because the two 'up's are
not the same up: systemd reports active the instant sclang execs, but the banks
register alphabetically after that and the rig is not playable until the end.
Measured today, active -> responder armed took 27 s, so under 30 s of uptime
the entry reads 'booting - Ns of ~30s' instead of claiming the sound is back.
A silent rig should never be a mystery.

Read on menu-open only, never on the 2 s thermal tick: it shells out to
systemctl, and paying that 30x a minute for a label nobody is looking at is the
per-tick cost this rig keeps getting bitten by. The restart runs through
QProcess so a two-second systemctl call cannot freeze the tray.

Verified: module imports clean, sc_state() reads (True, 145s) against the live
unit, fmt_dur spans 5s->2h13m, tray restarted and came back with no traceback.