refactor(status-all): expose target provenance

[gfargo]

Summary

Advance #248 by making status-all resolve each stack's health target through the same stack-aware env and topology layers used by normal dispatch, then expose where each status signal came from.

Changes

• resolve stack-level/project-level env files before applying topology defaults and host layers
• isolate each stack's health context so connection and topology state cannot leak between rows
• add flat JSON provenance for target scope, host alias/host, effective health env, and local rollback/backup evidence
• preserve the existing name, health, last_deploy, and backup_age fields and exit behavior
• render Target and local evidence labels in CLI and dashboard output
• retain compatibility with older cached dashboard JSON that lacks provenance fields

Validation

• bats tests/ </dev/null — 2,650 passed, 2 expected skips
• bats tests/test_status_all.bats tests/test_cmd_dashboard.bats </dev/null — 55 passed
• direct topology targeting, row-isolation, provenance serialization, and dashboard rendering smoke checks
• shellcheck -s bash lib/cmd_status_all.sh lib/cmd_dashboard.sh
• bash -n lib/cmd_status_all.sh lib/cmd_dashboard.sh
• git diff --check
• semantic review approved with no actionable findings

Advances #248.