feat(diagnostic): migrate to tile-preload + strict shims (Phase 3.11b-diagnostic)
- Replace api.invoke('backup-create/list/get-config') with api.backup.create/list/getConfig()
- Replace api.invoke('shell-open-path', {path}) with api.shell.openPath(path)
- Hardcode tile-preload assignment for peek://app/diagnostic.html in ipc.ts window-open
handler (Option A): mint a trustedBuiltin token on-the-fly using createTrustedBuiltinGrant
+ generateToken, same pattern as hud-glue/cmd-glue — no manifest file needed
- Import createTrustedBuiltinGrant from tile-manifest.js and generateToken from tile-tokens.js
- Zero api.invoke() calls remain in diagnostic.html; api.datastore.getTable kept as-is