Add IB Gateway diagnostics workflow

[Pigbibi]

Summary

• add a manual diagnostics workflow that SSHes to the gateway VM and prints safe runtime state
• include Docker status, host/container ports, 2FA watcher status, X11 window titles, 2FA bot logs, and Gateway logs
• avoid reading or printing credentials

Tests

• Not run; workflow-only diagnostic helper.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7650840ae7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Continue diagnostics when deploy path is unavailable

The remote script hard-fails on cd __DEPLOY_PATH__ under set -euo pipefail, so if the deploy directory is missing/corrupted (a common failure mode during broken deployments), the workflow exits before collecting host/container status, ports, and logs. That defeats the purpose of a rescue diagnostic run in exactly the scenarios where it is most needed; make the cd conditional (or gather non-path-dependent checks first) so diagnostics still run when the app directory is absent.

Useful? React with 👍 / 👎.