fix(health): close post-merge signal loop

[sandstream]

Summary

• make kit health fail closed unless every connected health finding is green
• treat latest GitHub Actions pending runs as non-green instead of falling back to an older successful run
• add Dependabot PR health coverage for failing, pending, conflicted, or ready dependency PRs
• include explicitly configured services in health sensor selection, not only auto-detected services
• add read-only PostHog health issue and Tinybird recent jobs sensors for analytics/data pipeline signals
• record the post-merge health-loop convention in shared memory

Verification

• npx prettier --check src/health.ts src/health.test.ts src/service-registry.ts src/service-registry.test.ts src/health-sensors/posthog.ts src/health-sensors/posthog.test.ts src/health-sensors/tinybird.ts src/health-sensors/tinybird.test.ts
• node --test --import tsx src/health.test.ts src/service-registry.test.ts src/health-sensors/posthog.test.ts src/health-sensors/tinybird.test.ts src/health-sensors/github-actions.test.ts src/health-sensors/github-dependabot.test.ts src/cli-health.test.ts src/health-track.test.ts
• npm run build
• node --test dist/health.test.js dist/service-registry.test.js dist/health-sensors/posthog.test.js dist/health-sensors/tinybird.test.js dist/health-sensors/github-actions.test.js dist/health-sensors/github-dependabot.test.js dist/cli-health.test.js dist/health-track.test.js
• node dist/cli.js health --json
• node dist/cli.js ci --format=json
• node dist/cli.js adr check
• git diff --check
• npm test (4702 pass, 0 fail)
• npm run lint (0 errors; existing warnings only)

[github-actions]

✅ Docker image built successfully

• CLI image: docker.io/sandstream/kit:test

[github-actions]

✅ Docker image built successfully

• CLI image: docker.io/sandstream/kit:test

[github-actions]

✅ Docker image built successfully

• CLI image: docker.io/sandstream/kit:test