fix(trusty-installer): probe trusty-mpm /health over HTTP instead of reporting unknown

[mac-duetto]

Closes #4925.

What changed

One match arm in crates/trusty-installer/src/commands/probe.rs — probe_member_health
now routes ManageStrategy::OwnVerb through the same HTTP transport as Launchd:

-        ManageStrategy::Launchd => probe_member_http_blocking(binary, binary),
-        ManageStrategy::OwnVerb | ManageStrategy::None => ProbeOutcome::Unprobeable,
+        ManageStrategy::Launchd | ManageStrategy::OwnVerb => {
+            probe_member_http_blocking(binary, binary)
+        }
+        ManageStrategy::None => ProbeOutcome::Unprobeable,

ManageStrategy was overloaded to mean two things that stopped being the same thing
in #4246: how a member is started/stopped, and whether its health is probeable. Those
coincided while the probe was <binary> health --json, a subprocess contract. Once
#4246 moved the transport to HTTP /health, probeability became a property of the
daemon's transport rather than its supervision model — but the match arm still keyed it
off the lifecycle enum, leaving trusty-mpm (the only OwnVerb member) reported as
unknown despite answering GET http://127.0.0.1:7880/health with 200.

Everything else in the diff is doc comments in the eight files that cited mpm as the
live "unprobeable" example, tests, a changelog.d fragment, and lockstep updates to
vmtest-harness/lib/verify.sh and the harness-contracts doc. stable_set.rs is not in
the diff at all — mpm keeps OwnVerb for lifecycle, which is what keeps needs_kickstart
unable to fire for it.

Accepted policy change

This is user-visible and was reviewed and accepted before implementation (see #4925).

A stopped trusty-mpm now yields tctl status → down / degraded / exit 2, and
tctl install → NOT VERIFIED, because mpm is required: true (stable_set.rs:181).
This makes mpm consistent with its declared required flag rather than exempt from it —
the same behaviour trusty-search, trusty-memory and trusty-review already have. CI that
gates on tctl status exit codes may start failing where it previously passed.

required: false demotion was explicitly not the chosen path. No env-var opt-out,
no probeable field, no second probe surface, no --json added to trusty-mpm health,
no mpm special-case in any caller.

Verification

Built the patched binary and ran it against the live daemon, with the pre-fix binary
installed at ~/.cargo/bin/tctl as a same-host, same-moment control:

$ ./target/debug/tctl status          # patched
  trusty-mpm         1.3.4        healthy
$ tctl status                         # pre-fix
  trusty-mpm         1.3.4        unknown

tga correctly stays n/a — the non-daemon arm is intact.

make check fails identically on this branch and on origin/main — the two Tauri
crates trusty-code-gui and trusty-mpm-gui both fail with The frontendDist configuration is set to "ui/dist" but this path doesn't exist, because crates/*/ui/dist
is gitignored and needs a pnpm build. Neither crate appears in this diff. Reproduced on
origin/main in a throwaway worktree, so the CI-equivalent gate (per
.github/workflows/ci.yml:23-28) was run instead:

Check	Result
cargo fmt --all --check	exit 0
cargo clippy --workspace --all-targets -- -D warnings (3 GUI excludes)	exit 0
cargo test --workspace (same excludes)	21972 passed, 0 failed, 139 ignored, 207 suites
trusty-installer package suite	554 passed, 0 failed, 4 ignored
line-cap / sld-lint / doc-numbers / test-pointers / generation-artifacts / changelog-fragment	0 violations

probe.rs is 252 SLOC against the 500 cap (was 217).

Tests

• Rewrote probe::tests::own_verb_member_is_unknown → own_verb_member_is_probed_over_http.
  Inverted rather than deleted, so the reversal is recorded where the carve-out was.
• Added probe::tests::own_verb_member_refused_when_nothing_listens — drives a real
  probe to Refused with OwnVerb and asserts needs_kickstart(&outcome, OwnVerb) == false.
  This is the safety-critical pin: a confirmed-down mpm must never be eligible for
  launchctl kickstart -k com.trusty.mpm, a label that does not exist.
• Added probe::tests::non_daemon_member_is_unprobeable — pins that None keeps
  Unprobeable, so the widened arm cannot creep to cover every strategy.
• Added verify_tail::tests::required_mpm_reporting_down_fails_verification.
• stable_set::tests::mpm_uses_own_verb and manage_strategy_for_matches_the_stable_set
  are unmodified and green — proof the lifecycle axis was untouched.

The one behavioural non-Rust edit

vmtest-harness/lib/verify.sh widens the H_P accepted-health set for
plist_installed == null members by one word:

-                    accepted="${accepted} unknown"
+                    accepted="${accepted} unknown down"

Without it the harness would go red on every run: the oracle snapshots tctl stack doctor
before anything starts daemons, so post-fix mpm reads down there, and down was
previously accepted only for plist_installed == false.

Net assertive power at that step is unchanged. null ⟺ daemon + OwnVerb ⟺ trusty-mpm
alone (doctor.rs:117-123, stable_set.rs:133); a Launchd member with a missing plist
gets Some(false) and already accepted down. Pre-change mpm read unknown
unconditionally at that site, so it asserted nothing about mpm either way. not_installed
is still rejected. mpm liveness was, and remains, asserted exclusively by
verify_daemon_liveness, which runs after tctl start --json, probes /health directly,
is unconditional in all three scenarios, and fails closed (die 60).

The scoping is clean — the false and true branches are untouched. The formal set
notation in 02-harness-contracts.md was updated in lockstep.

Follow-ups, not in scope

• tctl stack doctor and tctl stack health treat unknown health as passing #4847 stays open. It asks whether an undetermined health should advance a green verdict —
  a policy question this change does not resolve, even though it removes the only member
  that produced unknown in practice.
• mpm's /health envelope carries no version field (probe_http.rs:164-165), so mpm
  reports healthy and can never report stale. Version-floor detection does not apply
  to it.
• Post-widening, verify_stack_doctor cannot distinguish a serving mpm from a dead one,
  leaving verify_daemon_liveness as the sole assertion of mpm liveness. Not a regression —
  it already was — but worth recording.

🤖🤖🤖 Generated with trusty-mpm — https://github.com/bobmatnyc/trusty-tools