Estate health sweep

Read-only by contract. No deploys, restarts, env writes, or storage changes — if the sweep finds something that needs fixing, report it and stop; fixing is /change-service territory and a separate decision.

1. Coolify layer

• get_infrastructure_overview and find_issues.
• find_issues flags every healthcheck-less service as a running:unknown warning on every run — cross-check its list against the expected set before reporting any of them as a finding. A warning about an available Traefik update on the server is real signal, not noise — report it (fixing is a /change-service decision).
• get_version and get_mcp_version: if either differs from what docs/infrastructure.md's platform table records, report the drift (the MCP's tool names have changed between majors before — see "Tool surface" there).
• Which running:unknown statuses are expected (images without healthchecks) and which are real signal is documented in the inventory section of docs/infrastructure.md — read it and do not re-litigate the expected ones.