docs(design): define PF health and recovery states - #316

What changed

• Define canonical PF routing states: active, inactive, drifted, and unknown.
• Make readable unprivileged pfctl state authoritative.
• Define identity-bearing HTTP/HTTPS public probes when loaded rules cannot be inspected.
• Specify safe Gateway readiness behavior for every PF state without direct-backend hangs.
• Define detection and foreground recovery after macOS unloads rules.
• Prohibit background and read-only sudo use.
• Require pv ports:install to refresh healthy Gateway observations or invalidate only stale PF-derived readiness.
• Align status, doctor, and ports-status terminology, JSON evidence, exit behavior, and repair advice.

Why

Prepared files, installed files, loaded rules, and working low-port routing are different facts. Treating prepared files as active can select a readiness path that hangs when redirects are loaded, while treating failed unprivileged inspection as inactive produces false repair diagnoses.

The contract makes evidence and recovery explicit before implementation.

Checks

• git diff --check
• Documentation-only change; no runtime behavior changed, so tests were not run.

Refs #304
Refs #305
Refs #306