feat: Foundry AI-infrastructure audit for Free AI + Knowledge Base

[sarthakagrawal927]

Summary

• Extends FLEET_HEALTH_CONTRACTS for free-ai and knowledge-base with the ai-infrastructure-toolbox-automation contract: auth-safe probes, protected fail-closed probe, freshness model, provider cost/degradation evidence (Free AI), background-job lifecycle, storage ownership + reconstruction paths, and maintenance-only authority.
• Adds pnpm fleet:ai-infra-audit (scripts/fleet-ai-infra-audit.mjs + scripts/lib/fleet-ai-infra-audit.mjs) which runs the declared auth-safe probes live and emits a sanitized JSON + Markdown Foundry snapshot to .symphony/fleet-ai-infra-audit/.
• Adds 12 unit tests covering contract validation, privacy redaction, provider degradation vs outage classification, neuron budget utilization, corpus freshness (on-demand model), snapshot building, and Markdown rendering.

Privacy contract

The snapshot contains only: route name, HTTP status, latency, provider class, quota/degradation flags, daily budget utilization, storage ownership, and recovery owner. It contains no prompts, completions, retrieved chunks, corpus text, authorization headers, or credential-shaped strings (redacted in defense in depth). No provider tokens are spent and no private corpus queries are issued by any declared probe.

Why

This is the Foundry half of the OpenSpec automate-ai-infrastructure-toolbox change. It wires the per-service inventories (free-ai PR #22, knowledge-base PR #12) into a reusable, sanitized coverage audit that Foundry can run on a cadence without spending money or leaking private data.

What is NOT in this PR

• No deploy, no migrations, no credential rotation, no rate-limit changes.
• The inventory docs themselves live in the free-ai and knowledge-base PRs.

Test plan

• pnpm test — 373/373 pass (12 new tests)
• pnpm typecheck — 14/14 tasks pass
• pnpm lint — 0 errors (53 pre-existing warnings)
• pnpm fleet:ai-infra-audit -- --no-live — contract-only snapshot, contract OK
• pnpm fleet:ai-infra-audit — live: 15/15 probes pass (10 free-ai + 5 knowledge-base), no provider tokens spent, provider availability correctly classified as degraded (5 available / 64 degraded / 23 exhausted — partial degradation, not outage)
• Reviewer confirms the contract fields match the inventory docs in free-ai Add Droid handoff loop #22 and knowledge-base Fix package deploy workflow commands #12

Generated with Devin