ARM64 command API and health regression verification

Parent

Closes part of #281; parent remains open.

What to build

Verify the secured command boundary and canonical health contract in the real ARM64 container, then record the verified milestone in project state and roadmap. This ticket is the integration closure for the two implementation slices.

Acceptance criteria

• The ARM64 image builds successfully.
• Container health remains healthy with the legacy response shape.
• Disabled, unauthorized, rejected and authorized command API cases are verified in the container.
• Health totals and category counts are verified against the canonical registry behavior.
• Python unit tests and compilation checks pass.
• docker compose config -q passes.
• wiki/state/current.md and wiki/state/roadmap.md record results, risks and next work.
• A final two-axis review is performed against the pre-change baseline.

Blocked by

• Ticket 2: Authenticated legacy command execution (#284)
• Ticket 3: Canonical health catalogue (#283)