三层回退恢复机制（L0写前留档/L1恢复梯子/L2离线回滚）+ guard 父守护

- L0: files 插件写受保护系统路径(/etc 等)前自动留档，AbstractBeforeWrite 到 data/file_baseline
- L1: failback 受限 worker 执行恢复梯子 probe→还原DNS/proxy→还原LLM配置+ReloadFromConfig→probe，N轮有界
- L2: tracker changeset 持久化原文 blob，guard 离线 RollbackFromDisk 回滚 agentfs；SystemSnapshot 支撑
- guard 父守护: 心跳 IPC(PING/ACK unix socket, 文件心跳回退)、失败计数、退出码协议(42/43/44)、最后手段
- 发行版路径适配: system.protected_paths/network_paths 可注入，默认面向主流 Linux
- Windows 兼容: guard.go/failback.go 加 //go:build linux, guard_windows.go 提供 no-op 桩
- 修复: guard.yaml last_resort 键冲突、changeset Content 不落盘导致离线回滚丢原文

Build 全绿, vet 干净, system/recovery/ipc/tracker 单元测试全过

internal/network/monitor.go

@@ -44,6 +44,7 @@ func NewMonitor(interval time.Duration) *Monitor {
 			},
 		},
 		interval: interval,
+		status:   make([]EndpointStatus, 0),
 	}
 }
 
@@ -143,13 +144,20 @@ func (m *Monitor) AggregateResult() types.NetworkCheckResult {
 	defer m.mu.RUnlock()
 
 	result := types.NetworkCheckResult{
-		LLMAPIReachable: true,
-		DNSResolving:    true,
-		TCPReachable:    true,
+		LLMAPIReachable:     true,
+		EndpointsConfigured: len(m.status) > 0,
+		DNSResolving:        true,
+		TCPReachable:        true,
 	}
 	var totalLatency time.Duration
 	checked := 0
 
+	if !result.EndpointsConfigured {
+		// 无任何探活端点：不谎报"可达"，标为未配置
+		result.LLMAPIReachable = false
+		result.Error = "no LLM endpoints configured for health check"
+	}
+
 	for _, s := range m.status {
 		if !s.Reachable {
 			result.LLMAPIReachable = false