feat(control-loop): governed autonomous self-healing — detect AND heal

[mdheller]

What

The difference between a platform that pages a human and one that fixes it. Most platforms detect; almost none heal under governance.

tools/control_loop.py

ControlLoop senses conditions and, for each it may act on, runs the same governed spine a developer runs (admission → place → grant → verify → execute), sealing every action. Three properties make it safe to run unattended:

• Never acts ungoverned — every remediation goes through the grant + quota path. No valid Grant or over quota → nothing runs; it's recorded and the loop continues.
• Decides a persistent condition once per cooldown — no remediation storms (the estate's escalation-suppression discipline).
• One bad condition never kills the loop — a block, deny, or raised exception is caught, recorded, and skipped.

tick() is one sense→act pass; run(max_ticks, interval) is the daemon; ledger() is the sealed action log. sense and to_workload are pluggable, so the loop drives any detector (stale backend, fired advisory, drifted vendor…).

Tests

+6 (remediates through the spine, decide-once-per-cooldown, fail-closed block and quota-deny recorded without acting, exception isolation, multi-tick run) = 98 tools tests green; validate passes.

capd/self-healing-loop.mesh.capd.json (caps.compute.self-healing-loop) — ingested by the knowledge commons as a first-class reproducible citable capability. Wired validate REQUIRED + CapD checks, Makefile loop.