fix: harden R1 routing and session diagnostics

[vcruz305]

Summary

• add bounded startup routing probation to recover from control backends that carry housekeeping traffic but no jobs
• add privacy-safe, memory/CPU-bounded Claude stream-json diagnostics and a Claude compatibility check
• make doctor automation-safe and strengthen ACP exact-once/simulator contracts
• preserve Unix executable mode in downloaded CI artifacts and smoke-test the downloaded binaries

Validation

• 90 Bun tests passed, 0 failed
• TypeScript typecheck passed
• frozen install and dependency audit passed
• actionlint, Bash, and PowerShell validation passed
• npm dry-run and clean consumer install passed
• real multi-profile simulator: 11 passed, 0 failed
• independent lifecycle/security review: PASS, no P0/P1 blockers