Resolves #13924

Adds an internal orchestrator-side container-health diagnosis producer. The new service converts bounded read-observe facts into the existing recovery-diagnosis event shape: down containers classify to restart, sustained resource exhaustion and Ollama eval contention classify to throttle/shed, config drift escalates with diagnosis, and probe-only failures remain advisory.

Evidence: L2 (unit + static proof for the internal producer contract and orchestrator passive wiring) -> L2 required (diagnosis producer contract). No residuals.

Related: #13860 Related: #13874 Related: #13884 Related: #13914 Related: #13920 Related: #13923 Related: #13926

Deltas from ticket

This PR intentionally does not add a public MCP surface, public daemon route, graph-only dependency, socket mount, lifecycle actuator, or scheduled healing loop. It lands the producer contract and passive orchestrator wiring that #13914 / #13926 can consume through the approved KB/MC public surfaces.

Structural pre-flight: fast-path sibling lift under ai/daemons/orchestrator/services/; no ArchitectureOverview map update needed because this is another orchestrator service instance, not a new subsystem.

Test Evidence

• node --check ai/daemons/orchestrator/Orchestrator.mjs
• node --check ai/daemons/orchestrator/services/ContainerHealthDiagnosisService.mjs
• node --check test/playwright/unit/ai/daemons/orchestrator/services/ContainerHealthDiagnosisService.spec.mjs
• git diff --check
• npm run agent-preflight -- ai/daemons/orchestrator/Orchestrator.mjs ai/daemons/orchestrator/services/ContainerHealthDiagnosisService.mjs test/playwright/unit/ai/daemons/orchestrator/services/ContainerHealthDiagnosisService.spec.mjs
• npm run test-unit -- test/playwright/unit/ai/daemons/orchestrator/services/ContainerHealthDiagnosisService.spec.mjs — 9 passed
• npm run test-unit -- test/playwright/unit/ai/daemons/orchestrator/Orchestrator.invariants.spec.mjs test/playwright/unit/ai/daemons/orchestrator/services/ContainerHealthDiagnosisService.spec.mjs — 32 passed

Post-Merge Validation

• Consume ContainerHealthDiagnosisService.collectAndDiagnose() from the graph-independent bridge work so latest diagnosis input is readable without relying only on graph publication.
• Use #13914 / #13926 live smoke to prove a wedged model or unhealthy Memory Core container is visible through the public KB/MC tool path.

Commits

• fb6f8f0fa4 — feat(ai): produce container health diagnoses (#13924)

Authored by Euclid (GPT-5, Codex Desktop). Session 1be84a2d-a911-424a-bfb0-10a51fff6303.