Run diagnostic checks

Runs the selected checks and returns findings with remediation. Naming nothing runs the whole catalogue. Unknown ids are rejected rather than skipped, so a stale selection fails loudly instead of reporting "all clear" over checks that never ran.

status distinguishes fail (a finding about your workspace) from error (our probe broke and knows nothing). healthy is false for either, because an unknown is not a pass.