docs(adr): store machine-health finding mutes in their own state file - #8906

…8917)

No related issue: Phase 2 of the owner-approved machine-health
PC-checkup plan; implements ADR 0081 (#8906).

## Summary

Adds the integration slice that every new list-style check builds on:

- the FindingItem shape, with a stable FindingKey;
- the ReadState enum;
- a read-only `state/mutes.json` with its own schema;
- delivery of muted keys to checks as an argument.

A mute keeps an item listed but stops it from raising the check's
severity.

## Fix

- `lib/New-FindingItem.ps1` adds:
- `Get-FindingKey`: `<kind>:<first 16 hex of
SHA-256(lower(kind|identity))>`, over 9 kinds;
  - `New-FindingItem`;
  - `Assert-ReadState`;
- the unmuted severity fold (a ReadState other than `ok` or `absent`
never folds to OK).
- New `catalog/schemas/mutes.schema.json` at 1.0.
`approvals.schema.json` is unchanged byte for byte.
- `lib/Get-MutedFindingKey.ps1` adds `Get-MuteState`, which is
read-only: it creates no folder or file and never migrates TODO.md. It
also adds `Get-MutedFindingKey`.
- `lib/Read-SharedText.ps1` is the one share-delete reader (`FileShare
ReadWrite|Delete`). `Get-ApprovalState` and `Get-MuteState` both use it.
- `Get-CheckArgument` takes `-ScriptPath` and returns only the arguments
the check script declares. A new check that declares `-MutedKeys`
receives it without a per-id edit, and a check that doesn't declare it
is never handed it.
- `Invoke-CheckWithTimeout` moves to its own lib file in a separate
commit, with its behavior unchanged.
- The orchestrator reads mutes before the dispatch loop. The approvals
read is unchanged.
- `output-schema.md` documents the FindingItem `detail` shape, and
`approvals.md` documents mutes.json.
- Changelog fragment (`minor`): a downgraded plugin ignores mutes.json,
so muted items raise severity again until the upgrade. Nothing FAILs and
nothing is stripped.

Consumers found by grep:

- `Assert-ApprovalState` (approvals only, unchanged);
- `Get-ApprovalState` (now reads through `Read-SharedText`);
- the orchestrator's dispatch;
- setup `check` step 3 and `approve=` (approvals only, unchanged);
- `approvals.md`;
- the two modified test suites.

## Verification

- `run-tests.ps1` exits 0: 622 passed, 0 failed, 1 skipped.
- Filtered suites, each exit 0: `New-FindingItem`,
`Get-MutedFindingKey`, `Get-ApprovalState`, `Get-CheckArgument`,
`Invoke-CheckWithTimeout` and `Read-SharedText`.
- The end-to-end case goes through `Start-Job`: a mute for one item
returns `muted: true`, the item's WARN is ignored by the check severity,
and `items_count` is 2 with `muted_count` 1.
- Golden FindingKeys were recomputed independently with `sha256sum` and
with .NET.
- Host smoke (`-DryRun`) exits 0: 19 checks ok, 0 failed.
- The code-design review found 1 CRITICAL, 2 IMPORTANT and 7 SUGGESTION
findings. The CRITICAL (a hardcoded per-id mute list), both IMPORTANTs
and three suggestions are fixed in 2ca2f2a. A fresh-context phase
verifier passed 12 of 12 criteria at 2ca2f2a.

## Related

Next phases: the state writer, run lock and sync-root guard; then the
storage top-N check, the first check to emit FindingItems.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>