fix(onboarding): the AI panel claims an outage only when one was seen

The done screen folded the `unknown` provider verdict into `unhealthy` and
painted "This instance's provider is not answering right now." `unknown` is
an empty `provider_health` table, which is the state of every instance until
its first AI call — so the most common path through the screen made a claim
about something nobody had measured. It now falls to the neutral panel, which
says nothing either way; the offer is withheld in both cases as before.

The projection itself drew the same unearned conclusion from staleness alone:
a quiet instance whose last success was two days old read `unhealthy` without
any failure behind it. A verdict now needs an observed one — a row whose last
outcome was a failure — and a merely old success reads `unknown`.

docs/api/openapi.yaml

@@ -44493,11 +44493,13 @@ components:
             - unknown
           description: "Instance-wide health of the operator's shared providers (`admin-openai` / `admin-codex`), folded across
             all accounts and reduced to a tri-state: `healthy` when one of them demonstrably served somebody within the
-            last 24 h and no credential sits in its auth-failure cooldown, `unhealthy` when they have been tried and are
-            not working, `unknown` when nothing has been tried yet on this instance or the read failed. Deliberately
-            carries no count, no timestamp and no account identity — 'the provider of this instance last worked' is a
-            statement about the instance, not about other people. Fails closed: treat `unknown` exactly like
-            `unhealthy`. Reading this never probes a provider."
+            last 24 h and no credential sits in its auth-failure cooldown, `unhealthy` when the last outcome somebody
+            observed was a failure, `unknown` when nothing has been tried lately on this instance (including a brand-new
+            instance whose ledger is still empty) or the read failed. Deliberately carries no count, no timestamp and no
+            account identity — 'the provider of this instance last worked' is a statement about the instance, not about
+            other people. Fails closed for the offer: neither `unhealthy` nor `unknown` may be offered. They are not
+            interchangeable for copy, though — `unhealthy` is a verdict a client may state, `unknown` is the absence of
+            one and must not be reported as an outage. Reading this never probes a provider."
         serverProviderOffer:
           type: boolean
           description: "Whether the shared provider may honestly be offered to this caller in one tap. True only when all of: the