feat: add safe diagnostic bundle export

[ostapondo]

Summary

• add preview-first rescueloop diagnostics export with explicit --confirm writes
• package version/platform, health, bounded metrics, source status, integrity results, allowlisted configuration, and recent redacted logs
• enforce fixed archive members and explicit read/member/content/archive bounds

Privacy and safety

• excludes incident evidence, filesystem paths, launch arguments, tokens, endpoints, model payloads, and repair contents
• applies a second support-export redaction pass to logs
• refuses to overwrite an existing destination
• bounds health-side ledger validation and configuration reads
• no upload or telemetry is performed

MCP impact

No MCP change is needed. Diagnostic export is a privileged local filesystem operation and remains outside the read-only MCP incident surface.

Validation

• cargo fmt --check
• cargo test --workspace
• cargo clippy --workspace --all-targets -- -D warnings
• real preview/write/archive-content smoke test
• verified preview-only creates no archive and repeated export cannot overwrite