feat(scripts): fleet-status — freshness report over recorded input-hashes

[elronbandel]

Resolves #304. Rung 4 of #292's migration path (rules #293, hash primitive #298, label stamping #303).

What

The rule-14 comparison — the fleet's freshness becomes observable:

• containers/scripts/fleet-status.sh — for every static bake target: derive the registry ref from the graph's context column (the dot-safe join key — bake target names mangle models/gpt-5.4), read eval.input-hash from the image config at a tag, classify fresh / stale / unlabeled / absent. Everything non-fresh is "changed" under rule 14 — the set the next release must rebuild or retag (rung 5's input).
• .github/workflows/fleet-status.yml — dispatch-only, packages: read: runs the sweep against any tag, writes a per-verdict summary + a collapsible non-fresh list, warns on stale. Report-only; nothing gates. This is the report feat(release): end-of-run fleet inventory report (completeness + freshness) #233 wanted, keyed on content instead of build dates.
• tests/static/fleet_status.rs — offline (stubs docker on PATH): proves every verdict and every registry read shape — manifest list with attestation entries (labels live in the per-arch config, never the index — feat(release): incremental combos — skip unchanged via a content-hash tag #239's measured trap), single-arch config object, labeled-but-hashless, absent — plus the dotted-model ref map, over the real repo's 153 targets.

Design notes

• Combos are deliberately not read. A combo is stale iff one of its parents is (its hash is derived), so ~150 leaf reads cover the ~5,500-combo fleet — the audit-validated implication that keeps rung 5 off the thousands-of-registry-round-trips path.
• Read path handles both shapes: imagetools inspect --format '{{json .Image}}' yields a platform-keyed map for manifest lists and a bare config for single-arch images; the jq filter selects linux/amd64 // linux/arm64 or falls through, ignoring unknown/unknown attestations.
• Expected side is one fleet-hash run — graph and hashes share row order, so the join is a paste; inspects fan out over xargs -P.
• First real dispatch doubles as the push-and-readback proof for feat(release): stamp eval.input-hash on every pushed image #303's labels (a dry run can't push, so the registry has no stamped images until the next real fleet dispatch; until then everything reads unlabeled/absent — which is exactly what rule 14 says it should).

Rules checked against

• .agents/contributing/RULES.md 1–3 (resolves drift drift: delivery/RULES.md#14 — nothing compares recorded input-hashes against the repo (fleet freshness unobservable) #304; code-only; this section).
• .agents/delivery/RULES.md 13–14 (implements the comparison; the retag act is rung 5), 5 (report-only — no publish path).
• tests/static/RULES.md 1–3 (stubbed-docker test is offline, ~3.5s, never ignored).
• .agents/RULES.md 7–8 (bash + jq + xargs; no new dependencies).