fix: add strict read-only diagnostics

[icerain-cmd]

What

• add run-once --diagnostic, a fail-closed read-only state/config inspection path
• keep legacy --dry-run behavior but document that it may update retries, cursors, buffers, dead letters, and run logs
• prevent non-gateway CLI discovery from starting the embedded worker
• harden live migration locking, guarded child cleanup, detached gateway restart, and linked readiness validation
• bump the standalone package to v2.1.1

Why

The earlier operational verification called --dry-run side-effect-free, but that mode intentionally constructs the pipeline and can write local HEGI state. The new mode avoids pipeline construction and all Telegram, LLM, Memory Forest, archive, and run-log paths while validating a private stable SQLite snapshot.

Safety properties

• pins config/state paths through directory descriptors on Linux/WSL
• rejects symlinks, hard links, rebinding, concurrent mutation, unsupported schema, and corrupt state
• verifies main/WAL fingerprints before and after snapshotting
• keeps gateway/worker locks across migration mutations and diagnostic post-check
• does not alter the published v2.1.0 tag

Verification

• .venv/bin/python -m pytest -q: 179 passed
• isolated scripts/smoke-test.sh --python .venv/bin/python: 128 passed
• .venv/bin/ruff check .: passed
• bash -n scripts/migrate-existing-install.sh: passed
• git diff --check: passed
• security review: 0 release-blocking findings
• architecture/lifecycle review: 0 release-blocking findings

Live profile verification was read-only: operating config, state DB/sidecars, queues, archives, and approval artifacts retained identical fingerprints. No Telegram, LLM, archive, approval, or Memory Forest commit call was made.