feat(medic): repair registry + spine doctor — recovery that proves itself #5536

Mission Control build #2 (agent-built, coordinator-integrated over the truth ledger)

The Vapron medic contract, implemented and test-pinned: "repaired" is recorded only when the red check re-ran green — a restart exiting 0 proves nothing — and every decline is a recorded refusal with a machine-readable reason, because a medic that quietly declines looks identical to a broken one.

• Registry (closed action allowlist): stuck CI runs → requeue (imports the runner's own reaper); mirror reds → resync; blip-prone probes (peer:watch, dep:anthropic) → re-run-to-verify. Deliberate none-and-page: postgres/disk/TLS reds, healthz/readyz (autoheal owns containers), journeys (code defects), and doctor:* (a dead watcher can't be kicked from inside). clear-failed-deploy-marker is excluded by design — re-arming deploys over an unreviewed rollback is the 2026-08-19 incident again.
• Spine doctor: four doctor:* meta-checks (tick age, core/journey/surface row ages) persist through the existing check pipeline — a dead watcher pages like a dead service, boot-null renders yellow so deploys don't page, and doctor:* rows are filtered from the public incident feed (internal watcher names aren't customer information).
• Outcomes ledger medic_outcomes (migration 0129), budgets/cooldowns read from it so deploys can't reset them. /admin/medic renders registry, outcomes, watcher ages.

72/72 tests across medic+truth+runner-invariants after integration; typecheck clean.

🤖 Generated with Claude Code