feat(health): build evidence-linked fleet snapshots

[szmyty]

Summary

• consume the pinned Hygiene repository catalog and provider-neutral repository evidence through a defensive, read-only boundary
• adapt validated Egolint report v1 results without taking ownership of lint semantics
• compute transparent categorical conformance and maturity-evidence rollups while preserving declared maturity, stale evidence, unknowns, and advisory checks
• emit deterministic organization-health.json and organization-health.md artifacts from an explicit --as-of time
• add versioned schemas, upstream contract locks, pinned/offline fixtures, documentation, CLI smoke coverage, and golden-snapshot drift checks

Acceptance criteria

• Ingest the Hygiene catalog and repository evidence
• Define transparent maturity and conformance calculations
• Show unknown and stale data instead of guessing
• Publish machine-readable and human-readable snapshots

Validation

• python3 -m unittest discover --start-directory tests --pattern "test_*.py" --verbose — 43 tests pass
• python3 scripts/verify_fixtures.py
• python3 scripts/verify_health_fixtures.py
• Draft 2020-12 schema checks plus validation of both evidence fixtures and the generated health snapshot
• Ruff check and format-check for every new Python source, test, and verification script
• installed observatory-health --version and existing observatory-intelligence --version
• git diff --check

Boundaries and follow-up

• Observatory Publish a Hygiene conformance dashboard for every repository #5 still owns the organization/per-repository dashboard and richer conformance presentation.
• Live GitHub collection remains the next roadmap phase; this PR performs no network access at runtime.
• Pace Publish portfolio, landscape, and migration data products #2 can consume the deterministic snapshot and remains the owner of plans, mutations, and convergence PRs.
• The fixture snapshot is compatibility evidence, not a claim of a live fleet scan: one record is current, one adapted Egolint record is deliberately stale, and 25 repositories remain unknown.

Risk and rollback

The contracts are explicitly alpha and fail closed on unsupported versions or competing check identities. Reverting this commit removes the new entry point and artifacts without migrating or mutating external state.

Closes #1

Roadmap-Step: OBS-Q02