fix: address issue 111 reliability and trust findings

[pacphi]

Summary

• make managed heal outcomes explicit and preserve degraded/failed evidence
• classify SQLite failures and retain last-good usage evidence
• require verified backups before atomic settings or guidance replacement
• add bounded opt-in statusline diagnostics
• scope live process discovery to the current UID and document remaining boundaries
• add registry-derived trust manifests for setup and new host enablement
• surface ADR-0023 source health in the dashboard Usage UI
• add hermetic clean-machine and macOS packed-artifact coverage

Validation

• pnpm run check
• 84.32% line / 80.77% branch / 85.75% function coverage
• dashboard suite: 63 passed
• AQE SAST: zero vulnerabilities

Closes #111