feat(observability): log heap samples and a one-time pressure report

runtime.heap.sampled records heap, old space, RSS, external memory and
the work in flight every five minutes, every minute at or above 70 % of
the heap limit. At 85 % runtime.heap.pressure lists the oldest requests
and jobs in flight and the routes most of them share, once, re-armed
only after the heap falls below 70 % and thirty minutes pass. A
heap-limit crash leaves no other record of what the process was doing.

HEALTHLOG_HEAP_SNAPSHOT=1 adds one heap snapshot at that moment into
HEALTHLOG_DIAG_DIR (0700 directory, 0600 file), off by default.
docs/ops/heap-diagnostics.md warns that a snapshot holds decrypted
health data and keys and says how to delete it.

scripts/env-manifest.json

@@ -401,6 +401,23 @@
           "example": "2048"
         }
       ]
+    },
+    {
+      "name": "Heap diagnostics",
+      "description": "Opt-in heap snapshot for chasing an out-of-memory crash. Off by default; a snapshot holds decrypted health data and keys. See docs/ops/heap-diagnostics.md.",
+      "required": false,
+      "variables": [
+        {
+          "name": "HEALTHLOG_HEAP_SNAPSHOT",
+          "purpose": "Set to 1 to write one heap snapshot the first time the heap reaches 85 % of its limit.",
+          "example": "1"
+        },
+        {
+          "name": "HEALTHLOG_DIAG_DIR",
+          "purpose": "Directory the heap snapshot is written to. Default /tmp.",
+          "example": "/tmp"
+        }
+      ]
     }
   ]
 }