feat: opt-in post-install continuous health report (#17)

[solomonneas]

Summary

Implements issue #17: an opt-in, read-only post-install health report that rechecks the deployed stack using existing verify.sh / LXC / state plumbing.

Usage

sudo bash install.sh --health-report
sudo bash install.sh --health-report --components wazuh,misp
sudo bash install.sh --health-report --health-report-out /root/health.json

Off by default. Continuous monitoring is operator-scheduled (cron/systemd timer); the installer does not install a timer.

Behavior

• Probes each component: state status, LXC exists/running, one-shot verify.sh, integration.status
• Checks artifact freshness for result JSON / MCP config / state dir
• Emits machine-readable JSON to stdout and <state-dir>/health-report.json
• Exit 0 only when overall healthy; 1 otherwise
• Non-destructive: no deploy, integrate, destroy, or secret rotation

False-healthy guards

• Running LXC + failed verify.sh → unhealthy (not healthy)
• Missing or malformed required result artifact → overall unhealthy

Scope vs concurrent work

• Does not change emit_final_json / ATT&CK / MCP mitre surfaces (keeps clear of fix: result JSON reports skipped or soft-failed integrations as success #12 / feat: export a MITRE ATT&CK Navigator coverage layer for the deployed stack #16)
• Additive flag + new scripts/lib/health.sh + unit tests

Verification

./scripts/verify

All gates passed: 119 unit tests, shellcheck, manifest validation (exit 0).