LATU: add read-only runtime diagnostics

[LaurenIsACoder]

Series

This is PR 4 in the LATU runtime usability series. Its prerequisites are
already merged into master:

• LATX: support dual-target loader prefixes in release builds #365 (PR 1) supports user-scoped loader-prefix configuration for both
  translators.
• LATU: add a generic dual-translator status manager #369 (PR 2) adds the independent dual-translator runtime manager foundation.
• LATX: report runtime selection and guide loader failures #370 (PR 3) exposes selected runtime metadata and guides loader failures.
• This PR turns that foundation into a read-only runtime query and diagnostic
  tool.

Summary

• replace the installed shell status helper with a native GLib-only
  latu-runtime-manager while preserving the existing two-line status contract
• add current and list commands that query latx-x86_64 and latx-i386
  through their versioned --runtime-info interface
• add inspect-root to validate canonical x86_64 and i386 ELF loaders without
  executing guest code
• add doctor to diagnose the translator, selected runtime root, configured
  loader, and effective loader chain
• let doctor --program derive the guest ABI and real PT_INTERP from the
  program rather than asking users to know those details
• default ordinary queries and diagnosis to both ABIs, with --abi retained as
  an optional expert filter
• emit newline-delimited JSON for automation and stable exit statuses for
  ready, broken, and unknown results

Examples:

$ latu-runtime-manager current
$ latu-runtime-manager inspect-root /opt/x86-runtime
$ latu-runtime-manager doctor
$ latu-runtime-manager doctor --program ./guest-program

The manager follows translator-reported configuration precedence instead of
parsing LATX configuration files itself. It bounds translator output to 1 MiB
and ten seconds, validates strict UTF-8 JSON, confines runtime-root symlink
resolution, and validates loader ELF metadata before reporting a root ready.

Distribution-neutral scope

The product implementation does not read os-release, branch on distribution
IDs, invoke distribution package managers, or contain a distribution allowlist.
AOSC, Debian, and Fedora names occur only in the GitHub Actions container matrix,
where the same generic lat-pr-fast suite exercises the same code in different
build environments.

This PR is intentionally read-only. It does not download, create, install,
update, or remove a runtime, and it does not modify translator configuration.
Those provisioning operations remain follow-up work.

Commit structure

1. runtime: replace status script with native manager
2. runtime: query selected guest runtimes
3. runtime: inspect guest runtime roots
4. runtime: diagnose loaders for guest programs
5. tests: exercise diagnostics with real translators
6. docs: describe read-only runtime diagnostics

Each behavioral slice carries its focused tests. Target-dependent tests are
registered through Meson and selected by the generic lat-pr-fast suite rather
than by manager-specific GitHub Actions steps.

Validation

The history cleanup changed only commit boundaries and messages. The final
tree object before and after cleanup is identical:
f4b0c70b5fb0fcfc82b00474a7854b82fca9a953.

On a physical LoongArch host, the pre-clean product tree before the portable
build-wiring follow-up passed:

• incremental dual-target product build: passed
• lat-pr-fast: 17/17 passed with x86_64 and i386 translators enabled
• focused distribution-neutral manager query and diagnosis test: passed
• tests-disabled product build: passed, with no tests registered or built
• real built translators were queried through --runtime-info for both ABIs
• git diff --check, workflow YAML parsing, shell syntax, DCO, and final-file
  checkpatch validation: passed
• patch-series checkpatch: no errors; only the generic MAINTAINERS reminder for
  added files

The manager and translator product C sources in that native run are identical
to the cleaned final tree. This physical result does not claim validation of
the later build and CI wiring; that boundary is covered by GitHub Actions.

For the cleaned six-commit series:

• final-tree git diff --check, shell syntax, workflow YAML parsing, and DCO:
  passed
• per-commit checkpatch: no errors; only the generic MAINTAINERS reminder for
  commits that add or remove files
• the native-manager build, release packaging, portable Meson invocation, and
  install validation are complete in the first commit; no later commit repairs
  those paths
• GitHub Actions on cleaned HEAD cb63f58d1d8e: 22/22 checks passed
• AOSC, Debian, and Fedora lat-pr-fast: 17/17 passed in each environment;
  the real-translator, install, and native-manager tests all passed
• AOSC, Debian, and Fedora release builds and refreshed CI container builds:
  passed

The deterministic test runtime uses synthetic loader ELF files and skips guest
execution, so these results do not claim a real rootfs or translated guest E2E.

Checklist

• I have read CONTRIBUTING.md.
• Every commit contains a DCO sign-off.
• I have included relevant build and test results.