feat(self-check): add harness self-diagnosis / fleet conformance skill

New /self-check skill: each machine probes its own ClaudeTools harness wiring
(identity.json paths, required tooling, settings.json hooks, skill/command/script
set, vault decrypt, coord/Gitea connectivity, Ollama capability tier) and grades
RED/AMBER/GREEN against a checked-in provisional baseline manifest.

- Capability-tier model: architectural/OS/hardware differences (e.g. no local
  Ollama) select a fallback ruleset instead of failing.
- Duplicate detection: flags command/skill names that diverge between the repo
  and ~/.claude (the "same /cmd, different behaviour" cross-machine bug);
  CRLF-only diffs ignored.
- Memory check: index + orphan detection, plus a model-driven semantic pass for
  memories that contradict identity/settings.
- V1 is a census tool: --publish writes a per-machine census to coord
  (component selfcheck_<host>); fanout requests the fleet to self-check +
  self-remediate + re-publish; aggregate derives the proposed baseline. No
  machine ever fixes another.

Reviewed twice by the Code Review Agent; three CRITICAL coord-API bugs and the
CRLF false-WARN found and fixed, verified live against the coord API.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.claude/commands/self-check.md

@@ -0,0 +1,53 @@
+---
+name: self-check
+description: Self-diagnose this ClaudeTools machine's harness wiring (tools, identity, hooks, skills, commands, scripts, capability tier, connectivity) against the fleet baseline, and optionally publish the census to coord.
+---
+
+# /self-check — ClaudeTools Harness Self-Diagnosis
+
+Runs the conformance probe in `.claude/skills/self-check/scripts/self-check.sh`,
+which grades this machine RED/AMBER/GREEN against the provisional baseline manifest
+and accounts for capability differences (e.g. no local Ollama -> remote/none ruleset).
+
+See `.claude/skills/self-check/SKILL.md` for the full model. This command is a thin
+runner — invoke the **self-check** skill for interpretation and follow-up.
+
+## Run it
+
+Always pass a real UTC timestamp via `SELFCHECK_TS` (the script falls back to
+`date` if available, but pass it explicitly for correctness):
+
+```bash
+SELFCHECK_TS="$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+  bash .claude/skills/self-check/scripts/self-check.sh report
+```
+
+Modes:
+
+| Arg | What it does |
+|-----|--------------|
+| `report` (default) | Human-readable RED/AMBER/GREEN report. Exit 0/1/2 = GREEN/AMBER/RED. |
+| `--json` | Structured census JSON only (for piping/aggregation). |
+| `--publish` | Run + PUT the census to coord as component `selfcheck_<host>`. |
+| `fanout` | Broadcast a self-check + self-remediate + re-publish request to ALL_SESSIONS. |
+| `aggregate` | Read every machine's published census; print fleet table + proposed baseline. |
+
+## Typical flows
+
+**Just check this box:**
+```bash
+SELFCHECK_TS="$(date -u +%Y-%m-%dT%H:%M:%SZ)" bash .claude/skills/self-check/scripts/self-check.sh report
+```
+
+**Build the fleet baseline (V1 census):**
+```bash
+# 1) From any machine, request the fleet to report:
+bash .claude/skills/self-check/scripts/self-check.sh fanout
+# 2) Each instance (incl. this one) publishes:
+SELFCHECK_TS="$(date -u +%Y-%m-%dT%H:%M:%SZ)" bash .claude/skills/self-check/scripts/self-check.sh --publish
+# 3) Aggregate what came back:
+bash .claude/skills/self-check/scripts/self-check.sh aggregate
+```
+
+After running, summarize the grade and the FAIL/WARN items for the user with the
+exact fix commands. Do NOT auto-apply fixes — V1 is report-only by design.