feat(diagnostics): end-to-end tunnel check, stale state detection, MCP extensions

- diagnostics.py: TunnelCheckResult with SSH process liveness, port
  probe, and optional API health check; check_tunnel / check_all_tunnels
- cli.py: bridge status shows LIVE column and [STALE] marker when state
  says connected but PID is dead; bridge check wired to diagnostics
- state.py: read_raw_pid helper; _pid_alive exported for reuse
- capabilities.py: capabilities registry stubs
- mcp_server/server.py: expose check_tunnel and tunnel capabilities
  over MCP
- SCOPE.md: rapid orientation document
- workplans/OPS-WP-0001-diagnostics.md: workplan backing this feature
- tests: 207 passing (test_cli, test_mcp, test_diagnostics)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

SCOPE.md

@@ -91,6 +91,17 @@ Claude Code sessions run locally; the Custodian State Hub API runs locally. Remo
 
 ---
 
+## Provided Capabilities
+
+```capability
+type: infrastructure
+title: SSH reverse tunnel connectivity
+description: Named, auto-reconnecting SSH reverse tunnels with health checks and audit logging — keeps remote execution environments continuously connected to the local Custodian State Hub.
+keywords: [ssh, tunnel, reverse-tunnel, connectivity, remote, bridge, ops-bridge]
+```
+
+---
+
 ## Getting Oriented
 
 - Start with: `README.txt` (architecture, config format, CLI commands, MCP integration)