claude-code: add status, doctor and runtime attestation parity

[SignalLayerLabs]

Context

The Codex integration currently exposes stronger operational diagnostics than Claude Code.

A Claude Code user should be able to determine whether MARGINAL is installed, active and observing correctly without confusing integration capability with effective authority.

Contribution wanted

Bring Claude Code diagnostics to parity with the useful parts of the Codex integration.

Acceptance criteria

Expose through the existing diagnostic surface, where appropriate:

• integration installed / not installed;
• expected Claude Code hooks/plugin present;
• lifecycle evidence observed / not observed;
• tool evidence observed / not observed;
• configured capability;
• effective capability;
• degraded/fail-open state;
• evidence health;
• configured privacy mode;
• actionable next step when unhealthy.

Configuration files existing must not be treated as proof that hooks are actually running.

Claude Code must remain labelled Observe unless a separate evidence-backed change proves a stronger interception boundary.

Runtime attestation

Where possible, distinguish:

• configured integration;
• integration files present;
• hooks actually observed;
• current/live session evidence;
• historical persisted evidence;
• capability supported by the adapter;
• authority actually effective.

Do not collapse these into a single healthy/unhealthy flag.

Privacy

Diagnostics must not expose raw:

• prompts;
• command text;
• source code;
• tool output;
• session identifiers;
• workspace paths;
• credentials;
• private repository names.

Use synthetic fixtures only.

Validation

• Add characterization tests before changing diagnostic behavior.
• Add regression coverage for healthy, missing-plugin, missing-hook, stale-evidence and fail-open states.
• Preserve existing Codex/OpenCode/PrivacyCode diagnostics.
• Document exact Claude Code version(s) used during validation.