feat: add optional tcp ebpf evidence

[yairfalse]

Summary

• add optional TCP health evidence contracts for unavailable, mock, and Linux eBPF modes
• expose TCP health evidence through admin REST, remote client, CLI, and MCP
• feed TCP health ontology evidence into graceful diagnostics without making eBPF a routing dependency

Validation

• cargo fmt --all -- --check
• cargo test --workspace
• cargo clippy --workspace --all-targets -- -D warnings
• teko verify --claim abstraction --claim tcp-health --claim diagnostics --claim linux-probe --json
• teko close --json