48f15c1ece
With the gateway owning the suspend, the idle predicate covers every work source (agent turns, cron jobs, API-server runs, background work, fail-awake on unreadable sources) and the relay drains + flips before the freeze, so a long timeout no longer buys safety — real work always blocks the suspend and resume is sub-second. 5 idle minutes just bills idle RAM. Per-instance override stays config.yaml gateway.scale_to_zero.idle_timeout_minutes (D2). New behavior-contract test: invalid config values degrade to the module default (whatever it is), never zero/negative — asserts the RELATION, not the literal, per the no-change-detector-tests rule.