Judge whether what a module runs stays up, and say it (hq ADR 0240, to-be 48 Phase A)

A container that crash-looped after its compose applied passed every check the
gate had: nothing looked at what a module runs. The node-engine now judges every
long-running resource on every look — one read of the runtime, one per service
manager — keeps the restarts it counts across recreates and its own restarts,
and says the state in every report and as an event on change, again every minute
while not healthy. It reads only; nothing is restarted for being unhealthy.

internal/link/queue.go

@@ -477,3 +477,37 @@ func declaredIn(body []byte) string {
 	sum := sha256.Sum256(signed.Declaration)
 	return hex.EncodeToString(sum[:])
 }
+
+// SayHealth says a health statement on the link open now (novox/hq ADR 0240, to-be 48 §4), and whether
+// the bus took it. **Not through the worker**: a statement is a word about the machine as it is, not an
+// account of an apply, and it must not wait behind one — a container crash-looping while a long apply
+// runs is said while it runs. False with no link open, or one that cannot say it; the caller says it
+// again on its next look, and the next report carries it whatever happens.
+func (q *Queue) SayHealth(ctx context.Context, h Health) bool {
+	q.init()
+	q.mu.Lock()
+	bus := q.bus
+	q.mu.Unlock()
+	sayer, ok := bus.(HealthBus)
+	if bus == nil || !ok {
+		return false
+	}
+	body, err := json.Marshal(HealthSaid{Node: q.Membership.Node, Health: h})
+	if err != nil {
+		return false
+	}
+	saying, cancel := context.WithTimeout(ctx, q.timeout())
+	defer cancel()
+	if err := sayer.Health(saying, q.Membership.Node, body); err != nil {
+		q.Say("could not say this machine's health: " + err.Error())
+		return false
+	}
+	return true
+}
+
+func (q *Queue) timeout() time.Duration {
+	if q.Timeout <= 0 {
+		return 10 * time.Second
+	}
+	return q.Timeout
+}