feat(installer): add read-only forge doctor

[kricha-lab-dev-worker]

Summary

• add a strictly read-only forge doctor for installed Linux Gate/Worker deployments
• report deterministic receipt, identity, path, service, readiness, and schema checks with distinct unhealthy exit status
• bind Gate readiness to the exact release version and commit under the owner-secret HMAC
• preserve exact canonical v0.1.3 v1-proof compatibility only for rollback recovery
• fix rollback readiness to re-prove the previous release identity rather than the candidate identity
• run the installed candidate doctor in the existing privileged v0.1.3 → candidate acceptance

Safety invariants

• doctor never rewrites files, opens SQLite for migration, changes services, acquires transaction locks, or rotates credentials
• output contains only stable check IDs; no tokens, config contents, HMAC material, DB contents, or repository credentials
• systemd probes are observational (is-enabled / is-active)
• mutable and immutable path checks fail closed on unsafe metadata, ownership, modes, symlinks, or hardlinks
• current releases require v2 exact-release Gate proofs; legacy v1 is accepted only for canonical v0.1.3 at dfa09f5fd82a01b79c977cae20299db79ede9bdc
• auth-provider and remote repository checks remain explicitly deferred because no canonical read-only runtime contract exists yet

Verification

• strict RED→GREEN unit development on dev-worker-01
• go test -count=1 ./... — passed
• touched-package go test -race -count=1 — passed
• go vet ./... — passed
• go build ./... — passed
• sh -n scripts/*.sh — passed
• git diff --check — passed
• exact privileged installed-candidate doctor proof runs in PR CI

Part of #43