System sanity

Read-only checks for features that break silently — a setting hidden in env, or a provisioning step only scripts/up.sh runs (so a registry-pull box that never ran it looks healthy yet a feature is dead). Catches the missing MinIO bucket that fails every app build, an unconfigured updater (MANTLE_STACK_DIR) that hangs updates, missing secrets, a stray files root, a localhost public URL, an unloaded embedder model. Each failure shows the fix — nothing is changed from here.