The check context injects nothing: every check still reaches for the real git, spawn and clock

[MongLong0214]

Split out of #463 rather than half-implemented inside it.

What #463 landed

DoctorContext exists and carries opts, a monotonic now, and the memo that keeps hook-runtime running exactly once. The registry, the runner, crash containment and durationMs are all in.

What it does not

PRD §2.3 names the effect set a check should receive — cwd, git runner, spawn, clock, index opener. Only the clock is injected. Every check still calls execGit, spawnSync and openIndex directly against the process.

That was a deliberate scope call: threading five effects through thirteen checks touches every one of them, and #463's own constraint is that the text stays byte-identical. A half-injected context — some checks taking effects, others reaching around them — is worse than neither, because a test that stubs the context would then be testing an arbitrary subset.

Why it is worth doing

• Each run becomes testable in isolation (ADR-0032 §4's stated benefit, currently unrealised). Today a check's test needs a real repository on disk; doctor's read-only and no-network promises are documented invariants with no test that would catch a violation #461's invariant tests build four of them.
• test/doctor-invariants.test.ts stubs net.Socket and dns.lookup at the Node level precisely because there is no seam closer to the check. An injected spawn would let the no-network fence cover the spawned-git half it currently cannot see.
• The suite spends real seconds building git repositories for assertions that are about branching logic, not about git.

Scope

• Extend DoctorContext with git, spawn, env, openIndex, defaulting to the real implementations.
• Migrate the thirteen checks to take them from the context.
• One test per check that exercises a branch through a stubbed context with no repository on disk.

Acceptance

• No check references execGit, spawnSync or openIndex directly; the greppable form is that those identifiers appear only in the default context.
• The A doctor check row cannot say which subsystem it speaks for, and nothing prevents building an inconsistent one #462 text snapshot and the runDoctor is a hand-written array of ad-hoc functions: one throwing check kills the whole command, and nothing is timed #463 registry-order test stay green.
• At least one check's failure branch is asserted with no filesystem repository at all.

Out of scope

Changing any check's logic or output. This is a seam, not a rewrite.

Depends on #463.