Show the tunnel's peers as each machine sees them, and say on the bus when they move (hq issue 522)

ace's tunnel leg lost most packets while its own check called the tunnel
healthy, and nothing on the mesh could say which address and port the
hub saw for each peer, which is what tells a home router's port mix-up
from anything else. netcheck_tunnel answers each peer's endpoint, last
handshake and traffic, never a key, and netcheck now says when a
peer's endpoint changes or its handshake goes stale or fresh again.

modules/netcheck/cmd/netcheck/main.go

@@ -1,19 +1,24 @@
 // netcheck's Go tools bundle (novox/hq ADR 0188, ADR 0193): a process the node's runtime launches
 // and speaks MCP over stdio to, through the Go SDK. It serves the two checks that are the machine's
 // own sockets and resolver — a TCP connect, a DNS lookup (of the machine's resolver, or of one named),
-// and what listens here — and nothing that changes anything.
+// what listens here, and the private network's peers (hq issue 522) — and nothing that changes anything.
+// Beside them it watches the tunnel and says on the bus when a peer's endpoint moves or its handshake goes
+// stale or fresh again.
 // The module's HTTP check is its TypeScript bundle; the runtime serves both under one module.
 package main
 
 import (
+	"context"
 	"fmt"
 	"os"
 	"strings"
+	"time"
 
 	stdio "git.novox.be/novox/mesh-sdk/go"
 )
 
 func main() {
+	go watchTunnel(func(event string, body any) error { return stdio.Emit(event, body) })
 	// An empty name serves as the module the runtime names (MESH_SERVED_MODULE): netcheck.
 	if err := stdio.Serve("", tools()); err != nil {
 		fmt.Fprintln(os.Stderr, err)
@@ -23,6 +28,18 @@ func main() {
 
 func tools() []stdio.Tool {
 	return []stdio.Tool{
+		{
+			Name: "netcheck_tunnel",
+			Description: "The private network's peers as this machine sees them (what wg show reads): each peer's machine where " +
+				"the mesh's names say it, its allowed ips, the endpoint (address:port) it was last heard from, its last handshake " +
+				"and that handshake's age, whether it is stale (older than three minutes, or never), and the bytes received and " +
+				"sent. Never a key. On the hub it says what address and port every machine reaches it from.",
+			Run: func(map[string]any) (any, error) {
+				cx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+				defer cancel()
+				return readTunnel(cx)
+			},
+		},
 		{
 			Name: "netcheck_listening",
 			Description: "What listens on this machine: every TCP socket in the listen state and every bound UDP socket, " +
@@ -100,3 +117,7 @@ func tools() []stdio.Tool {
 		},
 	}
 }
+
+func say(format string, args ...any) {
+	fmt.Fprintf(os.Stderr, "[netcheck] "+format+"\n", args...)
+}