fix(agent99): harden scorecard readback

scripts/reboot-recovery/agent99-live-preflight.ps1

@@ -144,6 +144,17 @@ function Get-EvidenceReadback {
             })
           }
         } else { $null }
+        recoveryCoordinator = if ($rawEvidence.recoveryCoordinator) {
+          [pscustomobject]@{
+            verified = [bool]$rawEvidence.recoveryCoordinator.verified
+            requireFreshRebootWindow = [bool]$rawEvidence.recoveryCoordinator.requireFreshRebootWindow
+            rebootSloClaimed = [bool]$rawEvidence.recoveryCoordinator.rebootSloClaimed
+            scorecardStatus = [string]$rawEvidence.recoveryCoordinator.scorecardStatus
+            scorecardBlockerCount = [int]$rawEvidence.recoveryCoordinator.scorecardBlockerCount
+            readinessPercent = [int]$rawEvidence.recoveryCoordinator.readinessPercent
+            failedChecks = @($rawEvidence.recoveryCoordinator.failedChecks)
+          }
+        } else { $null }
       }
     } catch {
       $parseError = $_.Exception.GetType().Name
@@ -242,6 +253,8 @@ $evidence = @(
 $operatingSystem = Get-CimInstance Win32_OperatingSystem
 $taskFailures = @($tasks | Where-Object { -not $_.healthy })
 $requiredEvidenceFailures = @($evidence | Where-Object { $_.required -and -not $_.fresh })
+$selfCheckEvidence = $evidence | Where-Object { $_.name -eq "self_check" } | Select-Object -First 1
+$selfHealthSeverity = if ($selfCheckEvidence -and $selfCheckEvidence.safeSummary) { [string]$selfCheckEvidence.safeSummary.selfHealthSeverity } else { "unknown" }
 $alertIncoming = $queues | Where-Object { $_.relativePath -eq "alerts\incoming" } | Select-Object -First 1
 $alertRunning = $queues | Where-Object { $_.relativePath -eq "alerts\running" } | Select-Object -First 1
 $commandQueue = $queues | Where-Object { $_.relativePath -eq "queue" } | Select-Object -First 1
@@ -252,6 +265,7 @@ if (-not $manifest.runtimeMatched -or $manifest.mismatchCount -ne 0) { $blocking
 if ($taskFailures.Count -gt 0) { $blockingReasons += "scheduled_task_unhealthy" }
 if ($relayListeners.Count -eq 0) { $blockingReasons += "sre_alert_relay_not_listening" }
 if ($requiredEvidenceFailures.Count -gt 0) { $blockingReasons += "required_evidence_stale" }
+if ($selfHealthSeverity -ne "ok") { $blockingReasons += "self_health_not_ok" }
 if ($alertRunning.staleOverFiveMinutes -gt 0) { $blockingReasons += "stale_alert_execution" }
 if ($alertIncoming.count -gt 0 -or $commandQueue.count -gt 0) { $blockingReasons += "pending_work_before_reboot" }
 
@@ -275,6 +289,7 @@ $result = [pscustomobject]@{
     taskFailureCount = $taskFailures.Count
     freshRequiredEvidenceCount = [int]@($evidence | Where-Object { $_.required -and $_.fresh }).Count
     requiredEvidenceFailureCount = $requiredEvidenceFailures.Count
+    selfHealthSeverity = $selfHealthSeverity
     alertIncomingCount = [int]$alertIncoming.count
     alertRunningCount = [int]$alertRunning.count
     pendingCommandCount = [int]$commandQueue.count
@@ -292,6 +307,7 @@ Write-Output "TASKS_HEALTHY=$($result.summary.healthyTaskCount)/$($result.summar
 Write-Output "RELAY_LISTENER_COUNT=$($result.summary.relayListenerCount)"
 Write-Output "ALERT_INCOMING_COUNT=$($result.summary.alertIncomingCount)"
 Write-Output "COMMAND_PENDING_COUNT=$($result.summary.pendingCommandCount)"
+Write-Output "SELF_HEALTH_SEVERITY=$($result.summary.selfHealthSeverity)"
 Write-Output "BLOCKING_REASONS=$($blockingReasons -join ',')"
 Write-Output "SECRET_VALUE_READ=0"
 Write-Output "REMOTE_WRITE_PERFORMED=0"

scripts/reboot-recovery/tests/test_agent99_recovery_coordinator_contract.py

@@ -75,6 +75,8 @@ def test_coordinator_reads_only_bounded_summary_artifacts() -> None:
     assert "public-maintenance-edge-fallback.txt" in coordinator
     assert "windows99-vmware-verify.txt" in coordinator
     assert "scorecard.json" in coordinator
+    assert "base64 -d | python3 -" in coordinator
+    assert "-type f -name 'scorecard.json'" in coordinator
     assert "*.log" not in coordinator
     assert ".env" not in coordinator
     assert "auth.json" not in coordinator
@@ -88,6 +90,8 @@ def test_live_preflight_is_no_secret_and_no_remote_write() -> None:
     assert 'remoteWritePerformed = $false' in preflight
     assert 'Write-Output "SECRET_VALUE_READ=0"' in preflight
     assert 'Write-Output "REMOTE_WRITE_PERFORMED=0"' in preflight
+    assert 'Write-Output "SELF_HEALTH_SEVERITY=$($result.summary.selfHealthSeverity)"' in preflight
+    assert 'if ($selfHealthSeverity -ne "ok")' in preflight
     assert "runtime-manifest.json" in preflight
     assert "Get-ScheduledTask" in preflight
     assert "Get-NetTCPConnection -LocalPort 8787" in preflight