feat(s19): snapshot producer, restore-check, live doctor probes, bundle folding

[im-tyler]

What

The S19 tail from the programme (row #49): the snapshot producer, the restore-check command, doctor's store/clock probes, and folding doctor + the latest backup receipt into the support bundle.

• teploy-ship snapshot — produces the same archive shape as scripts/ship-backup.sh backup (<label>-<date>/nucleus-data-full.tgz + .sha256 sidecar + manifest.txt under SHIP_BACKUP_DIR, default /_backups). Refuses while any ship-* container it can see is running, printing the exact coordinated docker stop it expects, unless the operator attests with --i-stopped-writers. Never overwrites; never deletes anything except its own partial output after a failed production (so a failed tar cannot occupy the label+date slot forever — retention stays the operator's). Docker absent/unreachable is advisory, not a refusal: a box without docker can still take a snapshot.
• teploy-ship restore-check <archive> — verifies WITHOUT unpacking: sha256 sidecar in sha256sum -c form (the sidecar must travel with its archive), full-stream gzip integrity (node zlib, the honest gzip -t), and the tar content listing, failing on absolute or .. paths that would escape an unpack target. Exit 0 only for verified. The verdict is integrity-only and names the rehearsal (scripts/ship-backup.sh rehearse) as the restore proof — the unpack and rehearse steps stay in the script by design.
• doctor — store-connectivity and clock stop reporting blind unknowns when NUCLEUS_URL is set: read-only liveness (SELECT 1) and skew against the store's own clock (SELECT now()), each degrading to unknown rather than guessing. Store CONSISTENCY is deliberately not probed (cannot be established read-only while writers run); with no configured store both stay unknown and say why.
• Support bundle (scriptVersion 2) — now carries doctor.json and backup-receipt.txt (the latest backup manifest — the receipt, never the archive), both through the redaction gate and both degrading to note files.

Verification

• pnpm run lint clean; pnpm run build clean.
• Full pnpm test: 2180/2180 root, 222/223 scripts (1 skip = ship-backup.test.mjs rehearse-without-docker on a docker-present machine; the grader-sensitivity port-8901 test passed on the recorded run — it is the documented CI-run item on contention).
• New tests, fake fixtures only, no live systems:
  • src/snapshot.test.ts (11): archive shape parity with the script, running-writer refusal with the exact stop line, --i-stopped-writers attestation recorded in the manifest, docker-unavailable advisory, overwrite refusal with bytes unchanged, dry-run writes nothing, failed-production cleanup + retryable slot, tampered sidecar / wrong-name sidecar / missing sidecar, truncated archive with a re-computed sidecar caught by gzip (the checksum alone cannot), path-escape listing, receipt selection (newest, skips rehearsals, bounded).
  • src/install-doctor.test.ts (+4): SELECT 1 liveness true/false, store clock parsed from Date/number/ISO, garbage/throwing time query degrades the clock to unknown (runDoctor reports incomplete, not ready), probes wired through runDoctor (answering store = ready; silent store = not-ready with clock unknown).
  • src/support.test.ts (+2): bundle carries redacted doctor.json + receipt; both degrade to notes.
• CLI smoke-tested end to end against a fake ship root: dry-run, produce, overwrite refusal, restore-check, the script's own verify accepting the CLI-produced archive, and a file-store support bundle containing both new files.

Deliberately deferred

• The unpack (restore --into) and rehearsal remain script-only — they touch a live recovery.
• restore-readiness.ts still has no command of its own.
• Nothing in this tail has run against a live store or live docker; the probes are proven against fakes per repo discipline.

Programme row #49 and AUDIT_OPEN.md updated to match. No upstream defects found. DO NOT MERGE (slice discipline).