crash handler, model guard, status temp/fan, timeout fix

- SIGSEGV/SIGABRT crash handler in ui/main.cc prints stack trace to stderr
- Fixed onroad crash: guard update_model() against empty model position data
  (was dereferencing end()-1 on empty list when modeld not running in bench)
- Status window: added device temperature and fan speed
- Interactive timeout returns to splash/onroad (not ClearPilotPanel)
- bench_cmd dump detects crash loops via UI process uptime check
- bench_cmd wait_ready timeout increased to 20s
- Restored camerad to bench ignore list (not needed for UI testing)
- Updated CLAUDE.md with crash debugging procedures

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

selfdrive/ui/main.cc

@@ -1,4 +1,9 @@
 #include <sys/resource.h>
+#include <csignal>
+#include <cstdio>
+#include <cstdlib>
+#include <execinfo.h>
+#include <unistd.h>
 
 #include <QApplication>
 #include <QTranslator>
@@ -8,7 +13,27 @@
 #include "selfdrive/ui/qt/util.h"
 #include "selfdrive/ui/qt/window.h"
 
+// CLEARPILOT: crash handler — prints stack trace to stderr on SIGSEGV/SIGABRT
+static void crash_handler(int sig) {
+  const char *sig_name = (sig == SIGSEGV) ? "SIGSEGV" : (sig == SIGABRT) ? "SIGABRT" : "SIGNAL";
+  fprintf(stderr, "\n=== CRASH: %s (signal %d) ===\n", sig_name, sig);
+
+  void *frames[64];
+  int count = backtrace(frames, 64);
+  fprintf(stderr, "Backtrace (%d frames):\n", count);
+  backtrace_symbols_fd(frames, count, STDERR_FILENO);
+  fprintf(stderr, "=== END CRASH ===\n");
+  fflush(stderr);
+
+  // Re-raise to get default behavior (core dump / exit)
+  signal(sig, SIG_DFL);
+  raise(sig);
+}
+
 int main(int argc, char *argv[]) {
+  signal(SIGSEGV, crash_handler);
+  signal(SIGABRT, crash_handler);
+
   setpriority(PRIO_PROCESS, 0, -20);
 
   qInstallMessageHandler(swagLogMessageHandler);