fix(services): isolate command health failures

[codeforester]

Summary

Keep service-health aggregation running when a command check cannot launch or emits non-UTF-8 output. Command probes now use byte-preserving capture and convert execution failures into per-service diagnostics so later services remain visible.

Fixes #332

Validation

• bats tests/services_test.bats --filter 'health isolates'
• git diff --check

The regression fixture covers an executable without a shebang, invalid UTF-8 output, a required failure, an optional failure, and a later service that must still be reported.

[codeforester]

Reviewed head 27996ba against #332 (stacked on #339). No findings. Two good hardening changes for command health checks: text=False means a check whose output isn't valid UTF-8 can no longer raise UnicodeDecodeError and abort the whole status aggregation, and catching OSError (not just FileNotFoundError/PermissionError) covers ENOEXEC, ENOTDIR, E2BIG and similar launch failures. Each now becomes a failed CheckResult, which is exactly #332's "keep aggregation intact". The output was never used, so bytes are fine. Ready in stack order once CI finishes (one job was still running).