fix: layer dev DB readiness evidence

Refs #49

Merged by commander after reviewing Code Queue task codex_1779422762669_1. Adds redacted DB readiness layering and refreshes DEV endpoint/report evidence. Follow-up: deploy/verify the new readiness probe in DEV via standard image CI/CD.

docs/cloud-api-runtime.md

@@ -16,8 +16,9 @@ and verifies:
 
 - `GET /health` reports `status: "degraded"` when live DB persistence is not
   connected.
-- The DB contract reports required env names and redacted Secret refs without
-  exposing secret values.
+- The DB contract reports required env names, redacted Secret refs, env
+  injection, connection attempt status, connection result, and `liveConnected`
+  without exposing DB URL or secret values.
 - `gateway.session.register`, `box.resource.register`,
   `box.capability.report`, `hardware.invoke.shell`, `audit.event.query`, and
   `evidence.record.query` round-trip through the same runtime store.
@@ -35,8 +36,19 @@ The current runtime store is process-local memory:
 
 This is intentional for L1. If `HWLAB_CLOUD_DB_URL` and
 `HWLAB_CLOUD_DB_SSL_MODE` are absent, health reports `db.status: "blocked"`.
-If both env vars are present, health reports `db.status: "degraded"` and still
-keeps `db.connected: false`, `db.ready: false`, and `db.connectionChecked:
-false`; env presence is not live DB evidence.
+If both env vars are present, cloud-api attempts a short read-only TCP
+connection to the DB endpoint from the injected runtime env. The health payload
+keeps all endpoint details redacted and reports only:
+
+- `db.configReady`: required env names are present.
+- `db.connectionAttempted`: the runtime tried the live connection path.
+- `db.connectionResult`: redacted classifier such as `connected`, `refused`,
+  `timeout`, `dns_error`, `invalid_url`, or `unsupported_protocol`.
+- `db.liveConnected`: the TCP connection completed.
+- `db.ready`: currently aliases `db.liveConnected`.
+
+Env presence alone is not treated as green. If the runtime has env injection
+but `db.connectionAttempted` is false or `db.liveConnected` is false, the gate
+must stay blocked/degraded with the reported blocker.
 
 Fixture: `fixtures/cloud-api-runtime/minimal-runtime.json`.