[v0.91.8][runtime-v3][observatory] Complete authenticated WSS and feature proofs

[danielbaustin]

Outcome\nMake the API-only Runtime v3 launch and separate HTML Observatory demonstrate the complete supported feature surface truthfully.\n\n## Scope\n- Real authenticated bidirectional WSS exchange through Axum/Tokio/Rustls\n- Observatory health distinction between unimplemented, unavailable, failed, and healthy\n- Telemetry fields limited to configured sink capabilities\n- clean-checkout launch using one init file and configured port 20997\n- end-to-end feature matrix proving every claimed Runtime v3 feature and adapter\n\n## Acceptance\n- WSS handshake, authentication, bidirectional frames, rotation/revocation, and shutdown are tested\n- No URL-only, fixture-only, or metadata-only proof\n- Runtime remains API-only; HTML Observatory remains a separate client\n- Linux/macOS/Windows validation evidence or explicit platform blocker\n- Exact feature matrix has no unresolved claimed feature\n- FastWork validation, strict Clippy, and exact pre-PR review\n- Must complete before WP-12 soak/cutover starts\n\n## Non-goals\nThis issue does not redesign the HTML Observatory UI.

[danielbaustin]

Shared constraint: simplify while completing proof. Delete obsolete wrappers, duplicate launch/Observatory paths, and metadata-only proof code where replaced; record before/after physical LoC and require net reduction.