feat: add ataegina up --json (one-shot slot + readiness)

[noahhyden]

What & why

Fourth of five agent-native additions (docs/design/agent-native.md). Closes the "run up, then separately run ports to learn the slot" round-trip: up --json prints one JSON line — the ports --json slot shape plus started (surfaces launched) and a per-surface ready:

{"index":0,"repo_root":"…","frontend":{"port":5173,"url":"…"},"backend":{"port":8000,"url":"…"},"log_dir":"…","db":null,"started":["backend"],"ready":{"backend":true}}

• All human log/hook output goes to stderr (fd-3 swap), so stdout is pure JSON.
• ready honors --wait: with --wait it reflects the wait outcome and the exit code follows --wait (0, or 75 on a not-ready deadline); a plain --json does a single immediate check and stays exit 0 (fire-and-forget).
• restart --json works too — its stop-phase chatter is routed to stderr (fd-4 swap) so stdout is a single JSON line.
• The readiness section is unified (strict ate_wait_ready for --json/--wait, best-effort ate_report_ready otherwise); plain up behavior is unchanged.

Discipline

• Spec: docs/design/agent-native.md.
• Tests-first: tests/up_json.bats — 10 hermetic tests. Stdout purity proven by capturing stdout/stderr into separate vars (no run --separate-stderr, so no bats-1.5 dependency across CI runners); started/ready for backend/both/none; ready=true via a fake ss; the --wait 75 + ready-false path; db object; restart --json purity.
• Live verification: real python backend → up --wait --json gives ready:{backend:true} exit 0; never-binds → --wait=1 --json exit 75 ready:false; restart --json emits a single clean JSON line.
• Mutation red-teaming: drop-stdout-restore (JSON leaks to stderr), ready-always-false, and started-omits-frontend — each caught by distinct tests.
• Docs: README, man page, CHANGELOG, bash+zsh completion, in-script --help. Checksum regenerated. No new dependencies.

🤖 Generated with Claude Code