Supervisor for all hardware-facing subsystems of a robot.

Groups the sensor, controller, and link supervisors so that the hardware-facing tree has its own restart budget. When the budget is exhausted this supervisor shuts down, signalling that hardware control is unrecoverable. BB.Safety.Controller monitors this supervisor and force-disarms the robot when it dies, leaving infrastructure processes (registry, pubsub, runtime, bridges) running so external systems can still observe the failure and call BB.Safety.force_disarm/1.

The restart budget is configurable via the topology_max_restarts and topology_max_seconds settings on the robot DSL.