fix: classify D601 provider health signals

scripts/src/artifact-registry.ts

@@ -1080,6 +1080,29 @@ function asBool(value: string | undefined): boolean {
   return value === "true";
 }
 
+function registryHealthDecision(checks: Record<string, boolean>, commandOk: boolean): Record<string, unknown> {
+  const scopeChecks: Array<[string, boolean]> = [
+    ["systemd", checks.systemctlAvailable === true && checks.unitExists === true && checks.unitActive === true],
+    ["docker", checks.dockerAvailable === true],
+    ["registry-container", checks.containerRunning === true],
+    ["loopback-listener", checks.loopbackOnly === true],
+    ["registry-api", checks.v2Ok === true],
+    ["storage", checks.storageExists === true],
+    ["rendered-config", checks.configHashMatches === true && checks.composeHashMatches === true && checks.unitHashMatches === true],
+    ["registry-image", checks.imageMatches === true],
+  ];
+  const healthyScopes = scopeChecks.filter(([, ok]) => ok).map(([scope]) => scope);
+  const failedScopes = scopeChecks.filter(([, ok]) => !ok).map(([scope]) => scope);
+  const runtimeApiHealthy = checks.containerRunning === true && checks.loopbackOnly === true && checks.v2Ok === true;
+  return {
+    decision: commandOk && failedScopes.length === 0 ? "healthy" : commandOk || runtimeApiHealthy ? "service-degraded" : "retryable-transient",
+    retryable: true,
+    healthyScopes,
+    failedScopes,
+    runtimeApiHealthy,
+  };
+}
+
 function commandTail(result: CommandResult): Record<string, unknown> {
   return {
     command: result.command.length > 7 ? [...result.command.slice(0, 7), "<readonly-script>"] : result.command,
@@ -1247,11 +1270,13 @@ function statusFromValues(options: ArtifactRegistryOptions, values: Record<strin
     && checks.configHashMatches
     && checks.composeHashMatches
     && checks.unitHashMatches;
+  const decision = registryHealthDecision(checks, commandOk);
   return {
     ok: healthMode ? healthy : commandOk,
     readonly: true,
     installed,
     healthy,
+    ...decision,
     checks,
     observed: {
       unit: { path: values.unit_path, active: values.unit_active, enabled: values.unit_enabled },
@@ -1293,6 +1318,11 @@ function runReadonlyStatus(options: ArtifactRegistryOptions, healthMode: boolean
       readonly: true,
       installed: false,
       healthy: false,
+      decision: "retryable-transient",
+      retryable: true,
+      healthyScopes: [],
+      failedScopes: ["provider-ssh-command"],
+      runtimeApiHealthy: false,
       checks: {},
       expected: {
         endpoint: `http://${options.host}:${options.port}`,