apt-health canary: flag wedged/behind package manager on a periodic cron

[MagnaCapax]

Problem

A broken host package manager is both a maintenance problem and a security tell. When apt is wedged (or has been silently hooked so it reports 0 pending while the host is demonstrably behind), the host looks best-maintained precisely when it is least healthy — and nothing on the host flags it. PMSS has no periodic apt-health signal today.

Scope of THIS issue (one task)

A lightweight periodic apt-health canary — a /scripts/cron/ check on a longer cadence (~every 2 weeks), staggered by hostname-hash like the other PMSS crons, logging to /var/log/pmss/, surfacing only on a problem:

• apt-get update / apt-get -s upgrade exits non-zero, or
• reports 0 upgradable while the host is measurably behind (e.g. installed kernel/base older than the suite's current), or
• dpkg is in a broken/half-configured state

Reporting discipline

Clean = silent (log + exit). Only a problem surfaces. Generic maintenance signal, low cadence, low noise.

Definition of done

• check implemented + tested against a healthy host and a wedged-apt fixture
• root.cron wired with hostname-hash stagger, ~2-week cadence
• ADR only if the reviewer judges it a significant enough behaviour change; otherwise ships via normal update

Context

Companion to the host security self-scan (#955) — same cron harness, different concern (maintenance, not IOC). Kept separate per one-issue-one-task.

---

_{Tier-3 declared at filing: --why needs-fleet-coordination — GH#631 tier gate. Declared fix size: 80 lines vs 25-line body — size gate (operator directive 2026-07-29). Owner: etc/seedbox/config/root.cron in MagnaCapax/PMSS — owner gate.}