Deep health check for an external monitor

Unauthenticated, rate-limited and cached for 30 s. Answers ok, degraded or down with one named check per dependency and per background signal — D1, R2, Vectorize, the queue producer bindings, each cron's last heartbeat age, the email lane, dead-letter arrivals, the provider balance probe age, the platform spend breaker, orchestrator reachability and the active/stalled run counts. The body carries counts, ages and fixed tokens only: no identifier, no customer data and no thrown message. The HTTP status is always 200 — alert on the body. ops/monitoring.md is the runbook.