Fleet health code is untested against real hardware

Everything in the fleet work depends on those transitions being correct —
health-gated registration fires on the healthy edge and deregisters on the down
edge, so a false transition either withholds a working server or removes a live
one from rotation.

Worth exercising deliberately before building on it:

- a box that never becomes healthy (wrong port, vLLM crash-looping) — does it
stay `starting` past `health_grace_s` and then go `down`?
- a healthy box that dies — does it take `health_fail_threshold` (3) probes,
and does it recover cleanly when it returns?
- a box that flaps — does the state machine settle, or oscillate?
- `health_grace_s` is 1800, sized for a cold Gemma pull. Confirm a genuinely
slow start is not marked down at 1799 seconds.

Start by locating the fleet health state machine and the health-gated registration and deregistration paths described in the issue. Exercise the never-healthy, healthy-then-dead, recovery, flapping, and 1799-second slow-start cases. Done means the observed transitions match the stated thresholds: starting to down after health_grace_s, failure after three probes, clean recovery, and no premature timeout.

Written by the indexing model from the issue text.