feat: expose signed platform health status

internal/diagnostics/platform_health_test.go

@@ -0,0 +1,35 @@
+package diagnostics
+
+import (
+	"testing"
+	"time"
+)
+
+func TestValidPlatformHealthRequiresConsistentAggregateAndUniqueChecks(t *testing.T) {
+	now := time.Now().UTC()
+	valid := PlatformHealthInput{
+		Schema: PlatformHealthSchema, Status: "warning", ObservedAt: now,
+		Checks: []PlatformHealthCheck{
+			{Name: "public_https", Status: "healthy", Value: "http_200"},
+			{Name: "disk_usage", Status: "warning", Value: "used_percent=81"},
+		},
+	}
+	if !validPlatformHealth(valid, now) {
+		t.Fatal("valid report rejected")
+	}
+	inconsistent := valid
+	inconsistent.Status = "healthy"
+	if validPlatformHealth(inconsistent, now) {
+		t.Fatal("inconsistent aggregate accepted")
+	}
+	duplicate := valid
+	duplicate.Checks = append(duplicate.Checks, duplicate.Checks[0])
+	if validPlatformHealth(duplicate, now) {
+		t.Fatal("duplicate check accepted")
+	}
+	stale := valid
+	stale.ObservedAt = now.Add(-16 * time.Minute)
+	if validPlatformHealth(stale, now) {
+		t.Fatal("stale report accepted")
+	}
+}