Exercise the OpenBao health judge against native servers in every replacement state #4969

🤖 Generated by the Agentic Engineer (interactive Claude Code session)

Part of #4756. This is the second step of that issue's recommended order, after the offline health judge (#4962).

Problem

The health judge is proven only against synthetic captures. Nothing yet shows that real OpenBao servers produce the evidence it expects in the states that matter for a replacement: cold initialization, a sealed restart, a follower joining, a leader change, and an unavailable peer.

Outcome

A CI regression starts disposable native OpenBao servers (the pinned release, synthetic data and credentials, no cluster) and captures their real health responses in each of those states. The judge must return the expected verdict for every state. The existing bootstrap path, which initializes only the first server and then unseals its peers, stays unchanged.

Acceptance criteria

• Native servers at the pinned release, started from synthetic configuration with no production credential.
• Captures for: all healthy; one sealed after restart; one uninitialized; a follower mid-join; after a leader change; one server unreachable.
• The judge returns PROVEN, HOLD or UNKNOWN as expected for each state, and every capture uses the judge's documented format.
• The run states that it proves server behaviour only, not production storage or quorum.

Rough effort: Medium.