[BOUNTY] Add health check Prometheus stale-metric guard (#6)

[leo202000]

Summary

Adds a stale-metric guard to the health check Prometheus output, addressing bounty #6. Health check results are flattened into metric records, each annotated with its age and a stale flag before export, so outdated metrics are flagged rather than silently scraped.

Changes

• tools/health_check.py:
  • collect_health_metrics() flattens services/infrastructure/system results into metric records carrying service, environment, metric_name, timestamp, and status.
  • flag_stale_metrics() annotates each metric with age_seconds and a stale flag (stale when age exceeds STALE_METRIC_THRESHOLD_SECONDS, default 300s; metrics without a usable timestamp are reported stale so outdated data is never silently exported).
  • format_prometheus() emits Prometheus exposition text (tot_health_check_status, tot_health_check_metric_stale, tot_health_check_metric_age_seconds).
  • redact_secrets() redacts password/token/api-key/bearer values from exported diagnostic output.
  • New --prometheus/-p and --stale-threshold CLI flags; a stale_metrics array is included in --json output. Default output remains unchanged.
• docs/OPERATIONS.md: documents the new metrics and the stale-metric guard.
• tests/test_health_check_stale_metrics.py: unit tests covering fresh/stale detection, threshold boundary, missing timestamps, Prometheus formatting, redaction, and default-output compatibility.
• diagnostic/build-109814a2.logd + .json: required diagnostic bundle.

Testing

• python3 tests/test_health_check_stale_metrics.py -v -> 12 tests pass (fresh/stale metrics, threshold boundary, Prometheus format, redaction, compatibility).
• python3 build.py -> diagnostic bundle generated and committed (diagnostic/build-109814a2.logd, 14583 bytes, DIAG magic).
• Smoke-tested format_prometheus() and flag_stale_metrics() with fresh and stale timestamps.

Checklist

• Relevant modules affected by these changes build locally
• Tests pass locally
• Diagnostic build log is committed in this PR
• Documentation has been updated, if applicable
• Configuration or schema changes are documented, if applicable
• No generated build artifacts are committed, except the required diagnostic build log
• Changes are scoped to the PR purpose and avoid unrelated cleanup
• Security, privacy, and error-handling implications have been considered

---

• I would like to request that my diagnostic build log is removed before merging

---

Addresses bounty issue #6. Please let me know the process for claiming the $25 bounty once merged.

[zhaog100]

/claim

I'll implement this bounty task.

[Soengkit]

Thanks for the PR. I am closing this because Soengkit/zeroeye is only my working fork of the upstream repository, not an official bounty intake or payment queue. The fork parent/source is NemoMi/zeroeye: https://github.com/NemoMi/zeroeye. Please use the upstream owner current process for any submission or claim, and do not post payment details here.