Observe executor resources and current counter attachment

[ctfbruce]

Executor operators could see a selected eBPF mode but not whether its owned TCX links remained attached; dispatcher metrics lacked executor host-resource observations and any measure of whether disclosed keys were actually reaching the dispatcher. The existing bounded control report now includes daemon RSS/FDs, state-filesystem capacity/available space, and the current interface/hook/program match for both owned counter links. The authenticated metrics endpoint publishes fixed-cardinality aggregates with explicit unknown counts; missing, malformed, stale and disconnected reports cannot appear healthy.

Disclosure delivery lag. The exporter adds executor_disclosure_lag_seconds and executors_disclosure_lag_unknown: for each registered executor's current announced chain, the time since the oldest key its schedule makes due became disclosable (dispatcher clock, no acceptance skew) without this dispatcher having verified and recorded it, read from the key store's in-memory record only. Before any key is due the lag is a known zero; once a key is due, an executor is unknown until the first disclosure of that chain reaches this dispatcher process (at most one heartbeat for an honest executor, one heartbeat after a dispatcher restart). The observation covers the current registered session's chain only: it does not iterate retained previous chains, certify delivery of their undisclosed tail keys, verify tags or captured traffic.

Alerts. The opt-in required-counter alert now requires fresh attachment presence from every registered executor. DebugletDisclosureUnhealthy additionally fires when the lag exceeds 90 seconds (three maximal heartbeat intervals, equal to the report lifetime) or is unknown, and keeps firing while the sample is missing. A new executor-storage alert retains failures through missing reports and failed scrapes until fresh recovery. Attachment presence does not certify packet coverage or effective policing; daemon RSS/FDs exclude separate guest workers. No packet policy, enforcement algorithm, admission, schema or public discovery API changed.

Launcher preflight. The foreground launcher rejected recoverable interrupted SQLite writes before the daemon could apply its existing recovery. Its schema preflight now verifies a private recovery copy and leaves the original database/journal unchanged; the daemon retains ownership of actual recovery. Managed reinstall and strict read-only checks keep their boundaries.

Validation. Health slice: 49 focused race-test events with zero skips; three race-instrumented real TCX detach/recovery repetitions releasing every process/BPF handle; a production-node Hello check observing real resources and attached versus fallback counters; Prometheus rule tests with nine failure/recovery fixtures; 33 race-test events verifying recoverable preflight, unsupported-schema refusal and unchanged original/journal bytes. Lag slice: gofmt/vet/build and race tests over internal/dispatcher, internal/dispatcher/tag and transport/api; promtool check rules and promtool test rules with the pinned Prometheus 3.15.0, including before-change runs that fail as expected. Candidate CI on the reviewed health head f7f147c passed all 16 jobs (run 37014456246); the composed head with the lag slice passed all 16 jobs (run 37279734390).

Refs #116, #119. Completes the executor resource, attachment-presence and current-chain disclosure-lag observations. Denied-traffic measurements, independently measured clock uncertainty and settlement backlog remain outside the supported observation contract.