The forge says why a rollout is blocked: /api/v1/health surfaces it and the board shows it #540

GET /api/v1/health now reports the platform's guard, and the board's status line shows rollout blocked: <reason> while it holds. I ran the full forge.json check locally and it passes: tsc --noEmit clean, and 641 tests across 43 files with 0 failures. The last push had no new commits, so the forge's own run has not been re-triggered. Whether it passes there is unconfirmed.

What changed

• The health route returns { ok, version, draining, rollout: { state, reason }, incidents, checkedAt }.
• It reads the mounted forge-guard ConfigMap (status.json and checkedAt) read-only, with no Kubernetes API access.
• stuck gives rollout.state = "blocked" with that incident's message as the reason.
• held gives held.
• An empty or missing ConfigMap gives ok.
• If checkedAt is older than 10 minutes, the response says the platform's view is stale instead of reporting all fine.
• test/guard.test.ts covers the ok, blocked and held states, plus the stale case.

Why #485 was red

• Two earlier commits on this branch fixed it: more setup time for the board strip's two argon hashes and sign-in, which outran bun's 5 s default under load, and a shorter check.run that fits the 1000-character limit.
• If it fails again on the forge, check the tsc step first. A fresh checkout without bun install fails with Cannot find type definition file for 'bun'.

Left out

• No Kubernetes API access.
• No paging or alerting. forge-watchdog still does that.
• I didn't split the issue. The existing change was small and green.

Try it

• Put {"incidents":{"stuck":"quota refused new pod"}} in a forge-guard ConfigMap with a fresh checkedAt.
• curl /api/v1/health should show rollout.state as blocked, and the board strip should show the same reason.

🤖 Generated with Claude Code

Closes #476

I merged main into this branch and pushed it. The tsc step and the check's test run both pass locally (663 tests across 44 files, 0 failures).

forge.json was the only file that conflicted. src/http/api.ts merged automatically. main had changed check.run to list tests by name after --, and the branch had added guard to the old file list. I took main's form and added guard back, since that is the test file this branch brings. The command is 457 characters, well under the 1000-character limit.

The endpoint, the board status line and their behaviour are unchanged from the earlier description. GET /api/v1/health reports the forge-guard view as ok, blocked or held, and the board shows rollout blocked: <reason> while it holds.

To try it, put a stuck incident with a fresh checkedAt in the forge-guard ConfigMap. /api/v1/health should then show rollout.state as blocked, and the board strip should show the same reason.

🤖 Generated with Claude Code