feat(diagnostics): end-to-end tunnel check, stale state detection, MCP extensions

- diagnostics.py: TunnelCheckResult with SSH process liveness, port
  probe, and optional API health check; check_tunnel / check_all_tunnels
- cli.py: bridge status shows LIVE column and [STALE] marker when state
  says connected but PID is dead; bridge check wired to diagnostics
- state.py: read_raw_pid helper; _pid_alive exported for reuse
- capabilities.py: capabilities registry stubs
- mcp_server/server.py: expose check_tunnel and tunnel capabilities
  over MCP
- SCOPE.md: rapid orientation document
- workplans/OPS-WP-0001-diagnostics.md: workplan backing this feature
- tests: 207 passing (test_cli, test_mcp, test_diagnostics)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/bridge/state.py

@@ -51,6 +51,16 @@ class StateManager:
             return pid
         return None
 
+    def read_raw_pid(self, name: str) -> Optional[int]:
+        """Read PID from file without liveness check. Returns None if file absent/invalid."""
+        path = self._pid_path(name)
+        if not path.exists():
+            return None
+        try:
+            return int(path.read_text().strip())
+        except (ValueError, OSError):
+            return None
+
     def write_pid(self, name: str, pid: int) -> None:
         self._ensure_dir()
         self._pid_path(name).write_text(str(pid))