fix(decdn_node): make the systemd watchdog opt-in

The role cannot tell whether the binary it installs heartbeats, and a
binary that does not is killed every period, so decdn_node_watchdog_sec
defaults to 0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: alpergundogdu

ansible/roles/decdn_node/defaults/main.yml

@@ -406,13 +406,14 @@ decdn_cli_bin: /usr/local/bin/decdn
 # templates/decdn-node.service.j2.
 decdn_node_stop_timeout_sec: 300
 
-# systemd WatchdogSec for the node unit (seconds). The node heartbeats from its
-# tokio runtime every half period, so a runtime whose workers never yield is
-# killed and restarted instead of staying `active` while it serves nothing. It
-# needs a decdn-node build that sends the heartbeat: an older binary sends none
-# and is killed every period, so set 0 to omit the watchdog for such a binary.
-# See templates/decdn-node.service.j2.
-decdn_node_watchdog_sec: 60
+# systemd WatchdogSec for the node unit (seconds); 0 omits the watchdog. The node
+# heartbeats from its tokio runtime every half period, so a runtime whose workers
+# never yield is killed and restarted instead of staying `active` while it serves
+# nothing. It needs a decdn-node build that sends the heartbeat (decdn/decdn#2145):
+# an older binary sends none and is killed every period. The role cannot tell which
+# build it installs, so the watchdog is opt-in: set e.g. 60 once the deployed binary
+# heartbeats. See templates/decdn-node.service.j2.
+decdn_node_watchdog_sec: 0
 
 # --- Lifecycle: backup + decommission (tasks_from: backup / decommission) -------
 # Only read by those entry points (playbooks/backup.yml, playbooks/decommission.yml);