Story: CLI 'consensus node upgrade-diagnose' command (diagnose + recovery plan, HIP step 3j)

Part of the consensus-node upgrade-lifecycle CLI commands. Implements the operator diagnostic command referenced by HIP XXXX2 self-upgrade **step 3j** (HIP line 1715) and described in the implementation guide / network-upgrade mindmap.

> **Command surface (current):** `solo-provisioner consensus node upgrade-diagnose`, part of the unified `consensus node` command set. The earlier `network upgrade diagnose` name is dropped (see consensus-node-command-surface memory).

## Context

When a network upgrade is stuck or has failed, the operator runs this command for guided diagnosis. It is the **read-only** advisor half of the diagnose→recover pair (#717 is the mutating repair). It never mutates host or cluster state — any resolution it identifies is surfaced for the operator to run manually.

## Tiered behaviour

- **Tier 1 — diagnose + emit recovery plan:** inspect `self-upgrade.yaml`, the JSONL upgrade event log, recent daemon logs, `NetworkUpgradeExecute` CR status, installed-vs-declared versions, and `.bak` presence; present a structured summary of what went wrong. Where the cause is recognised, **write a reviewable recovery-plan artifact** (e.g. `/opt/solo/weaver/.../upgrade-recovery-plan.yaml`) describing the proposed repair actions, and tell the operator to review and run `consensus node upgrade-recover --plan ` (#717). Diagnose itself never executes the plan.
- **Tier 2 — escalation bundle:** if diagnosis cannot determine or resolve the issue, generate a single timestamped artifact tarball (the artifacts collected above) under a known path and instruct the operator to **contact Hedera support** with it.

## Scope

- New CLI command `solo-provisioner consensus node upgrade-diagnose`.
- Tier-1 diagnosis + recovery-plan emission; Tier-2 escalation tarball.
- **Strictly read-only** — no restore, no restart, no CR writes, no auto-execution of the plan.
- Document the new command + flags in `docs/quickstart.md`.

## Acceptance criteria

- Recognised failure → structured diagnosis + a reviewable recovery-plan artifact + instruction to run `upgrade-recover --plan ` (not executed automatically).
- Unrecognised / unresolved failure → self-contained escalation tarball + "contact Hedera support" message.
- Does not modify any host file, binary, or CR; never auto-runs the plan.
- Degrades gracefully when the cluster is unreachable or the daemon is down (collects what it can, notes what is missing).

## Dependencies

- `self-upgrade.yaml` schema (#529), JSONL event log (`pkg/eventlog`).
- Produces the recovery plan consumed by `upgrade-recover --plan` (#717).