R20K R02 continuation: procd service isolation hardening and candidate full-config versus endpoint-only diagnostics

diagnosis=FULL_CONFIG_REQUIRED_FOR_LOCAL_REPAIR
endpoint_only_pass_count=0
full_config_pass_count=3
full_config_required_evidence_count=3
completed_matrix_rows=12
system_restored=true
state_unchanged=true
active_slots_healthy=5

No managed VM101 source was changed. The active five-slot state, quarantine, events, counter and network file were required to return byte-for-byte to baseline.