完成 ARM 应用健康监控上线（07-27-arm-app-health-rollout）

.trellis/spec/hyb-oa/deployment-trialrun.md

@@ -1135,6 +1135,12 @@ PGPASSWORD="$POSTGRES_PASSWORD" docker exec -e PGPASSWORD db pg_dump ...
 - `install` writes only the exact managed probe/helper/state/unit targets and
   leaves the timer disabled. `enable`, ARM writes, real robot messages and a
   controlled failure/recovery drill remain separately approved operations.
+- Before any remote write, prove the selected SSH identity can run `sudo -n`
+  and that no application-health artifact already exists. A password prompt is
+  a stop condition, not permission to request or transmit a password in chat.
+  If the operator creates a temporary privilege rule, remove its exact file at
+  the end, validate sudoers in the same root invocation, invalidate the sudo
+  timestamp and prove the original non-interactive access is gone.
 - `uninstall` removes only the exact application-health units and probe. It
   retains the shared helper, webhook, state evidence and all backup components.
 
@@ -1149,6 +1155,11 @@ PGPASSWORD="$POSTGRES_PASSWORD" docker exec -e PGPASSWORD db pg_dump ...
 - A first isolated failure followed by health -> no failure or recovery message.
 - Any overridden managed target or service name -> installer stops before
   `systemctl`, file replacement or removal.
+- SSH succeeds but `sudo -n` requests a password -> stop before upload or
+  systemd mutation; resume only after an operator establishes a separately
+  approved, non-chat root path and rerun the complete preflight.
+- Temporary privilege rule remains after final health verification -> rollout
+  is incomplete even when the timer is healthy.
 - ARM itself or its network/robot path unavailable -> the monitor can be silent;
   do not report this design as having an independent third-party dead-man.
 
@@ -1169,6 +1180,10 @@ PGPASSWORD="$POSTGRES_PASSWORD" docker exec -e PGPASSWORD db pg_dump ...
   corrupt private state, URL rejection and absence of sensitive output.
 - Run Python compile and shell syntax checks, validate the five-minute calendar,
   and assert disabled-by-default plus exact managed targets and retained state.
+- For a remote rollout, record boolean evidence for pre-write `sudo -n`, exact
+  temporary-upload removal, temporary privilege removal and post-removal
+  non-interactive-sudo failure; never record the password, host address or rule
+  contents.
 - Re-run `bash scripts/qa/run-automatic-backup-contract.sh` whenever the shared
   helper allowlist or behavior changes.
 - ARM install, enabled/active timer status and real failure/recovery messages are