fix(status): the dead-server claim renders only when the off-box writer is armed #5552

Owner asked whether the 100%/90+ figures are real. They are real arithmetic — over an incomplete ledger: HEARTBEAT_REPORT_TOKEN is unset in production, so the off-box incident writer 401s every call (deliberate fail-closed per heartbeat-report.ts) and has never been able to file. The Aug 22 full-box outage therefore never landed as an incident, and the page's unconditional claim that "a dead server still shows as downtime here" was false in practice.

The claim now renders only when the token is armed; while unarmed, the page says plainly that the figures are a floor on downtime, not a ceiling. Arming the token (box env + workflow secret, both sides) is an owner action — secrets never transit this channel.

Typecheck clean; status + heartbeat suites 49 pass.