Reconcile Linux safety fixes and prevent false-success backup, health and log checks

[blow-tech]

Continues the approved Linux fixes on the existing draft PR. This revision reconciles current main without discarding its four newer scripts. Nothing is merged or deployed.

Problem and changes

Backup age rounding, failed filesystem collection, and suppressed log scan errors could report successful checks despite stale backups or unavailable evidence.

• backup_verify.sh: exact age in seconds, validated arguments, NUL-safe filenames, explicit enumeration failures and unsupported-integrity errors.
• healthcare_check.sh: UNKNOWN for failed/empty/malformed collections, one memory/swap collection, bounded external queries, preserved mountpoint spaces and validated thresholds.
• log_summary.sh: regex validation, explicit read/decompression failures, per-file timeout, numeric rotation scope and large-summary SIGPIPE fix.

The ten September script fixes and two shared modules are retained: verified versioned backups, retention previews, missing dependency repair, alert-only service monitoring, Nginx previews and rollback, separated Apache/firewall operations and scoped audit checks.

Reconciliation and validation

• Main reconciled: 81ae9b030416ec45e3cb21605dc1e63a079c0b6a.
• New head: 6834cd2fc659fa047cdf1847e2aac84b6eebc986.
• Published Git tree exactly matches the locally validated tree.
• 28 isolated tests passed locally: 12 retained regressions and 16 new collection regressions; all 17 Bash sources/modules parse.
• Includes disposable archive restore/preservation tests and mocked collector, scan-error and timeout statuses. No production targets, scans, services or notifications were used.
• Existing Actions workflow validates this revision; see checks for remote results.

Migration and remaining gates

Alert on every nonzero exit; the three updated checkers use exit 3 for UNKNOWN and exit 2 for usage. Log rotation discovery now includes only .N and .N.gz; pass date-named rotations explicitly. Unsupported archive formats cannot pass requested integrity checks.

Review changed backup targets/mount identity, service arguments, preview/apply interfaces and protected output directories before migrating schedules. Actual application restore, Nginx reload/rollback and environment integration remain lab gates. Archive/checksum publication is not one transaction; preserve and investigate partial artifacts.

Full change list and migration notes.

Scope is this Linux administration repository. The separate PowerShell, audit-toolkit and infrastructure findings remain outside this change. No blanket production-safety or benchmark claim.