fix(app-control): require a Ready command that fails when the instance is unfit #10145

Parent: #7195 (split slice: a defect the first-consumer pass found, owner decision Q112 of 2026-10-25).

Problem

The control-skill contract's ## Ready row asks for one read-only command that shows a running
instance is fit to drive (plugins/app-control/reference/control-skill.md:29). Drive and
/testing:run-e2e treat that command's exit as the readiness verdict
(plugins/app-control/skills/drive/SKILL.md:110, plugins/testing/skills/run-e2e/SKILL.md:226).
Nothing requires the command to fail when the instance is unfit, and map's Generate step does not
say so either (plugins/app-control/skills/map/SKILL.md:107).

In the first-consumer pass against melodic-software/medley identity-server, the first Ready was
curl ... && docker ps --filter "ancestor=<image>" --format .... The filter matched nothing
because the app pulls its image by digest, and docker ps exits 0 with no rows, so Ready passed
with the data store unverified. The next version matched any container of that image, including
another tool's, and still passed with the app's own database down. Reading the output caught both;
the exit code caught neither.

Fix

• The contract's Ready row and map's Generate step require each check in the command to exit
  non-zero when it fails (for a listing, grep -q on the expected row, not the listing alone).
• Map's prove step runs Ready once with the app stopped and records that it exits non-zero, beside
  the passing run with the app up.

Done when

• reference/control-skill.md and skills/map/SKILL.md state the rule.
• skills/map/reference/prove.md "Checks after the proof" adds the app-stopped Ready run.
• /app-control:map check reports a Ready command whose last stage is a bare listing.
• scripts/check-changelog-fragments.sh passes.