feat(health): expose fsck as kb.fsck on mcp/jsonl/capabilities

[philluiz2323]

What changed

health.fsck() is now registered on MCP (kb_fsck), JSONL (kb.fsck),
and capabilities.METHODS, mirroring kb_doctor's registration exactly.
The CLI mirror (vouch fsck) already existed and needed no change — it
already matches the default kb.foo → vouch foo naming rule
test_cli_commands_match_methods checks against.

Why

health.fsck() (orphaned embeddings, dangling supersede/contradict
chains, decided-proposal ↔ artifact mismatches, index-vs-file drift) was
called from exactly one place: cli.py's fsck command. kb.lint and
kb.doctor both have full four-surface registration; fsck — the
deepest of the three checks — was the one gap, leaving an agent no way
to run it without shelling out to the CLI.

Closes #738

What might break

Nothing — purely additive. health.fsck() itself is completely untouched;
this only wires its existing, unmodified output to three more surfaces
the same way kb.doctor already does.

Heads up for review: while testing this I confirmed health.fsck() on
current test HEAD still crashes with an uncaught KeyError on any
approved DELETE (and separately, GOAL) proposal — the bug my own
#735 (still open) fixes. That crash is pre-existing and orthogonal to
this PR (it lives entirely inside _check_decided_proposals, which this
PR never touches) — but worth flagging that exposing kb.fsck here makes
that crash reachable from MCP/JSONL agents too, not just CLI users of
vouch fsck. I'd suggest merging #735 around the same time as this one
if convenient, though neither PR strictly depends on the other.

VEP

Not applicable — no object model, on-disk layout, bundle format, or
audit-log shape change. A registration-only change wiring an existing,
unmodified function to three more surfaces.

Tests

• Local make check-equivalent: ruff clean (src + tests); mypy
  clean; tests/test_health.py, tests/test_capabilities.py,
  tests/test_hot_memory.py, tests/test_cli.py all pass
• New behaviour has tests — 3 new cases in tests/test_health.py:
  JSONL kb.fsck result matches a direct health.fsck() call,
  findings round-trip through the JSONL envelope (not just the ok
  flag), and a pin confirming kb.fsck's default CLI-mirror name
  correctly resolves to the pre-existing fsck command with no
  _CLI_MIRRORS entry needed
• CHANGELOG.md updated under ## [Unreleased]