feat: add privacy-safe server diagnostics

tools/repository-hygiene.test.mjs

@@ -289,6 +289,7 @@ test('single-source and generated-output boundaries remain explicit', async () =
   const packageJson = JSON.parse(await readFile(path.join(ROOT, 'package.json'), 'utf8'));
   const dockerfile = await readFile(path.join(ROOT, 'Dockerfile'), 'utf8');
   const compose = await readFile(path.join(ROOT, 'docker-compose.yml'), 'utf8');
+  const diagnoseServer = await readFile(path.join(ROOT, 'infra/diagnose-server.sh'), 'utf8');
   const gitignore = await readFile(path.join(ROOT, '.gitignore'), 'utf8');
 
   assert.match(template, /^交付版本：0\.5\.123\s*$/mu);
@@ -298,6 +299,13 @@ test('single-source and generated-output boundaries remain explicit', async () =
   assert.match(packageJson.scripts.start, /\.build\/control-plane/u);
   assert.match(dockerfile, /\.build\/control-plane/u);
   assert.match(compose, /\.build\/control-plane/u);
+  assert.match(compose, /x-default-logging:\s*&default-logging/u);
+  assert.match(compose, /max-size:\s*"\$\{LOG_MAX_SIZE:-20m\}"/u);
+  assert.match(compose, /max-file:\s*"\$\{LOG_MAX_FILES:-10\}"/u);
+  assert.equal((compose.match(/logging:\s*\*default-logging/gu) || []).length, 3);
+  assert.match(diagnoseServer, /health\/ready/u);
+  assert.match(diagnoseServer, /docker compose --env-file \.env\.production/u);
+  assert.doesNotMatch(diagnoseServer, /cat\s+\.env|printenv|env\s*$/mu);
   assert.match(gitignore, /^\.build\/$/mu);
   assert.match(gitignore, /^\.env$/mu);
   assert.ok(!existsSync(path.join(DIST, 'control-plane')));