On-demand operational health for one named audit store.

Health checks signing-key availability, the latest background-verifier result, and the distance from the independently stored checkpoint to the current ledger head. It performs only bounded reads: health endpoints never trigger a complete ledger verification or advance a checkpoint.

That restraint is deliberate twice over. A health endpoint that walked the ledger would hand anyone who can reach it an unbounded query, and one that advanced a checkpoint would let a liveness probe anchor history nobody had verified.

healthy? requires that the next write could actually be signed, not merely that past writes verify. Those are different questions, and answering only the second produces the worst possible report: a store whose history is intact, whose signing key cannot be resolved, and which therefore fails every write while reporting itself well. Distance from the last checkpoint is reported rather than judged, because how far behind is too far is an operational decision this library cannot make.