三层回退恢复机制（L0写前留档/L1恢复梯子/L2离线回滚）+ guard 父守护

- L0: files 插件写受保护系统路径(/etc 等)前自动留档，AbstractBeforeWrite 到 data/file_baseline
- L1: failback 受限 worker 执行恢复梯子 probe→还原DNS/proxy→还原LLM配置+ReloadFromConfig→probe，N轮有界
- L2: tracker changeset 持久化原文 blob，guard 离线 RollbackFromDisk 回滚 agentfs；SystemSnapshot 支撑
- guard 父守护: 心跳 IPC(PING/ACK unix socket, 文件心跳回退)、失败计数、退出码协议(42/43/44)、最后手段
- 发行版路径适配: system.protected_paths/network_paths 可注入，默认面向主流 Linux
- Windows 兼容: guard.go/failback.go 加 //go:build linux, guard_windows.go 提供 no-op 桩
- 修复: guard.yaml last_resort 键冲突、changeset Content 不落盘导致离线回滚丢原文

Build 全绿, vet 干净, system/recovery/ipc/tracker 单元测试全过

internal/network/monitor_test.go

@@ -0,0 +1,39 @@
+package network
+
+import "testing"
+
+func TestAggregateResultNoEndpoints(t *testing.T) {
+	m := NewMonitor(0)
+	res := m.AggregateResult()
+	if res.EndpointsConfigured {
+		t.Error("no endpoints configured should be false")
+	}
+	if res.LLMAPIReachable {
+		t.Error("LLMAPIReachable must not be true when no endpoints configured")
+	}
+	if res.Error == "" {
+		t.Error("should report no-endpoints error")
+	}
+}
+
+func TestAggregateResultWithEndpointsUnreachable(t *testing.T) {
+	m := NewMonitor(0)
+	m.mu.Lock()
+	m.status = []EndpointStatus{{URL: "http://127.0.0.1:1/", Reachable: false, Error: "dial refused"}}
+	m.mu.Unlock()
+
+	res := m.AggregateResult()
+	if !res.EndpointsConfigured {
+		t.Error("endpoints configured should be true")
+	}
+	if res.LLMAPIReachable {
+		t.Error("unreachable endpoint should make LLMAPIReachable false")
+	}
+}
+
+func TestAllReachableEmpty(t *testing.T) {
+	m := NewMonitor(0)
+	if m.AllReachable() {
+		t.Error("AllReachable must be false with no endpoints (not vacuously true)")
+	}
+}