feat: estate report (ak status --all) #444

Why: One read-only view of every opted-in project on this machine and whether it is current. Design: estate convergence, delivery section "4.1.0: the estate report". Master plan Decision G14.

In scope: ak status --all aggregates each opted-in project's state/status.json into one table and cacheDir()/estate.json (cache, rebuilt each run): root, kitVersion pin against the running version, each tool pin against its support window, projection drift, snapshot age, verdict (current, stale, needs attention, unknown) and the exact command to run there. --refresh re-collects two projects at a time. The dashboard's Health, Needs attention and Versions in use cards read the same aggregate.

Out of scope: Moving any pin; scheduling; pin policies (v5, decision X1); any write inside a project.

Acceptance criteria:

• Writes only estate.json in the cache; the real-state tripwire shows no project file change
• A project with any pin outside the support window is reported stale and never moved
• A snapshot older than 7 days is reported with its age
• The CLI table and the dashboard cards agree on every project's verdict

Blocked by: #356, #357
Blocks: #445

Plan: release 4.1.0 (milestone); size:M, ws:capability (labels); no parent epic (capability card, like #255).

Verification: node scripts/run-tests.mjs focus <the estate tests>; ak status --all in a disposable HOME holding three opted-in projects, one of them stale.