feat: add Linux server diagnostics wave

[RomeoRaven]

Summary

• add ten standalone Linux/Ubuntu diagnostics for filesystem, memory, services, listeners, updates, backups, endpoints, TLS, containers, and log storage
• preserve read-only operation and privacy-reduced defaults with explicit metadata opt-ins
• add catalog, checksum, launcher, README, and mock-driven behavioral coverage
• harden decimal parsing, TLS identity/chain verification, target syntax, executable path quoting, curl configuration isolation, and collection failure semantics

Verification

• ./tests/test-scripts.sh — 183/183
• ./tests/test-linux-modules.sh — 148/148
• ./tests/test-launcher.sh — 102/102
• ./onescript doctor — catalog, 14 modules, files, checksums OK
• sha256sum -c --strict SHA256SUMS — 16/16
• Bash syntax, pinned ShellCheck, and staged diff checks clean
• exact-tree fail-closed independent rereview passed with no security concerns, logic errors, or suggestions

[RomeoRaven]

Code Review Summary

Verdict: Merge-ready

Findings

• Blocking: none
• Warnings: none
• Suggestions: none

Reviewed

• exact head 232deb58e517573a7211211999124bb40a24f80b against master
• all 16 changed files and full production-script context
• read-only and privacy-reduced boundaries
• option, arithmetic, path, endpoint, TLS, package, container, and failure semantics
• README, catalog, checksum, launcher, tests, and CI consistency

Proof

• ./tests/test-scripts.sh: 183/183
• focused Linux suite: 148/148
• launcher suite: 102/102
• doctor and strict checksums: clean
• pinned ShellCheck: clean
• PR diff hygiene and targeted security sweeps: clean
• both GitHub Actions checks: passed

No merge was performed. GitHub does not permit an author to approve their own PR, so this review is submitted as a non-blocking comment.