feat(diagnostics): end-to-end tunnel check, stale state detection, MCP extensions

- diagnostics.py: TunnelCheckResult with SSH process liveness, port
  probe, and optional API health check; check_tunnel / check_all_tunnels
- cli.py: bridge status shows LIVE column and [STALE] marker when state
  says connected but PID is dead; bridge check wired to diagnostics
- state.py: read_raw_pid helper; _pid_alive exported for reuse
- capabilities.py: capabilities registry stubs
- mcp_server/server.py: expose check_tunnel and tunnel capabilities
  over MCP
- SCOPE.md: rapid orientation document
- workplans/OPS-WP-0001-diagnostics.md: workplan backing this feature
- tests: 207 passing (test_cli, test_mcp, test_diagnostics)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/bridge/capabilities.py

@@ -68,6 +68,11 @@ CAPABILITIES: list[Capability] = [
         description="Show bridge metadata",
         required_access_modes=frozenset({"cli", "mcp"}),
     ),
+    Capability(
+        name="bridge_check",
+        description="End-to-end tunnel diagnostics via SSH: SSH PID alive + remote port listening",
+        required_access_modes=frozenset({"cli", "mcp"}),
+    ),
 ]
 
 CAPABILITIES_BY_NAME: dict[str, Capability] = {c.name: c for c in CAPABILITIES}