feat(diagnostics,minimal): incident collectors, mechanics in-crate - #864

Unit 5 of the diagnostics series (epic #801). The wedged-system captures
— network state, process tree, hang triage, and power history — land as
mechanics in the `diagnostics` crate, parameterized by app inputs, with
only the marker list and the six `collect_step!` wiring lines in
`crates/minimal`.

- `diagnostics::net` (R5.1): listening sockets (ss/netstat, Linux
  /proc/net fallback), interfaces with MACs masked to their vendor OUI,
  and routes — verbatim tool output, no typed re-serialization.
- `diagnostics::procs` (R5.2): process table + hang triage for up to 8
  pids matched by argv0 basename against a caller-supplied marker list.
  Linux is pure /proc (wchan/syscall/stack/fd), so it runs as microVM
  pid-1 with no external binaries; macOS uses `sample` + `lsof`. Recorded
  argv is scrubbed token-wise: any key=value token whose key trips the
  sensitive-key policy has its value replaced by the redaction
  placeholder.
- `diagnostics::power` (R5.3): sleep/wake history (macOS pmset, Linux
  journalctl), event-capped.
- All three run their command captures through a new lenient
  `diagnostics::capture::command_stdout`, which honors the lsof/ss
  exit-1-with-output convention (R5.4).

The marker *data* (`PROCESS_MARKERS`) and the wiring stay in
`minimal/src/diag/mod.rs`; the crate never names a process or a bundle
path prefix — both are passed in — so the same mechanics serve the
daemon-side capture (Unit 6). The net socket-probe stays out: it needs
the CLI client and belongs to Unit 7.

Refs: #801

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Three review findings on the Unit 5 process collectors, all real:

- `proc_scrape` walked all of /proc with synchronous std::fs from an async
  task, so the caller's `collect_step!` timeout could not preempt it. `ps`
  being absent — microVM pid-1, a starved host — is exactly when that read
  is most likely to wedge, and it would strand the worker thread instead
  of being bounded. It now runs on a blocking thread, matching the rule
  the CLI's state-listing collector already follows and the workspace
  standard against blocking in async.
- `proc_status` had the same hazard from `process_tree`'s per-pid loop,
  with a smaller blast radius; same fix.
- `hang_triage` sampled up to 8 pids sequentially at 15s each plus lsof —
  up to 130s against a 30s budget, so it was truncated mid-loop and later
  pids and lsof were lost, precisely on a wedged machine. The macOS
  samples now run concurrently, so the pass is bounded by one deadline
  rather than their sum: ps (5s) + samples (10s) + lsof (8s) ≈ 23s worst
  case. Raising the caller's budget instead would let `min bug` block for
  over two minutes on a hung host — the wrong direction for a tool whose
  job is to return evidence quickly.

Sample results are sorted by pid so bundle contents stay deterministic
regardless of completion order.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Two more review findings on the collectors:

- `hang_triage` took its pid set from one `process_table` snapshot and then
  read kernel state and open-file paths from those pids. If a matched
  process exits and its pid is recycled in between, the bundle records an
  unrelated process's fds and stack — exactly the "someone else's
  activity" the marker filter exists to keep out. Linux now re-checks each
  pid against its own `/proc/<pid>/cmdline` immediately before reading it,
  and only the pids that still match are handed to `lsof`; a pid that lost
  its identity is recorded as a skip. The read is async, so it costs no
  subprocess and no blocking.
- `proc_net_listeners` walked tcp/tcp6/udp/unix but not udp6, so IPv6 UDP
  sockets vanished from the fallback capture on exactly the hosts that
  need it (no `ss`/`netstat`). Added.

The macOS `sample` path keeps the snapshot pids: re-validating there costs
another `ps` pass against a budget just tightened, and `sample` names the
process it sampled in its own output, so a recycled pid is visible to the
reader rather than silently misattributed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>