Returns a platform-scoped health aggregation for the Admin Console:

• services[]: per-container availability (AVAILABLE/UNAVAILABLE/UNMEASURED, derived
  from each service's liveness probe) + serving (READY/DEGRADED) + CPU/heap/disk/uptime,
  fanned out S2S to each service's actuator over the overlay (Tier 1).
• node: host CPU/memory/disk aggregate from the collector's internal hostmetrics
  listener (Tier 2); null when the listener is not reachable.

Availability reports what was OBSERVED, and the third literal is what keeps it honest.
A response RECEIVED at any status is evidence about the probed service: it yields
AVAILABLE when the service reports itself live, and UNAVAILABLE when it answers and
reports itself not live. A timeout, a refused connection, or the fan-out's own deadline
is evidence about the PROBER, not about the service — nothing about the service was
observed, so the row is UNMEASURED. UNMEASURED is not an outage and must not be read
as one.

Degrade-in-place: no probe outcome fails the request. A service that could not be
measured degrades in place to availability=UNMEASURED with null resource fields, and
no internal detail is leaked — detail is cause-neutral and never names a host, port,
status or cause. The endpoint still returns 200; only an aggregator-internal fault
yields 500. The node block degrades to null independently.

• evaluatedAt: when the evaluation that produced this document ran.

Snapshot-served (PRD 161). This document is NOT probed per request: the platform alert
evaluator performs one fan-out per evaluation interval (60s by default), stores it, and
both this endpoint and the alert state read that stored evaluation. The document may
therefore be up to one interval old, and evaluatedAt says exactly how old. The reason
is not caching: the panel and the alerter must be incapable of reporting different
verdicts, which a per-request fan-out cannot guarantee because each caller measures
separately.

• stale: whether the served evaluation is older than the platform can vouch for.
  Decided by the server from evaluatedAt and the evaluator's armed interval, so
  every replica answering at the same instant answers the same way and no client
  needs a clock of its own. A stale document is served WITH its last measured rows
  and its measurement time: it is a last-known reading, not current fact.

Before the first evaluation completes, services[] is empty, evaluatedAt is
absent and stale is false. That is reported as absence rather than as a healthy
platform, and absence is not staleness — there is nothing yet whose age could be
judged.

Authorization: admin.platform.observability.read (platform/ROOT admins only).