doctor workspace: runnable-bindings checked in the wrong naming scope, and --json stdout carries log lines #1254

What breaks

obin-ai/platform-core's composition gate (scripts/composition-check.sh) runs these steps on CLI 0.1.230:

codefly generate runnable-bindings --env local --naming-scope composition-gate
codefly doctor workspace --json > doctor.json
jq ... doctor.json

The doctor step fails in two ways. Both are new since 0.1.218, the last CLI on which this gate passed on platform-core main.

1. doctor workspace checks runnable bindings in a naming scope it cannot be told

CheckRunnableBindings, which cmd/doctor_workspace.go:1329 calls, prepares the expected bindings with env.NamingScope, the environment's declared scope. #1209 added this, and 0.1.221 is the first release that carries it. A file generated with --naming-scope X has different addresses, so doctor reports:

configuration_invalid: cannot use generated runnable bindings: runnable-bindings is out of date: run `codefly generate runnable-bindings --env local` (required by runtime/worker, robin/chat)

codefly generate runnable-bindings --env local --naming-scope X --check passes on the same file. doctor workspace has no --naming-scope flag, so a workspace that runs under a naming scope, as codefly run --naming-scope and the generator both support, cannot pass doctor. Reproduced on 0.1.221, 0.1.226 and 0.1.230.

2. doctor workspace --json writes log lines to stdout before the JSON

On 0.1.230, stdout starts with:

(WARN) (configurations.composedModuleOffers.resolve) composed modules disagree on a workspace configuration; it is unavailable until the solution declares it configuration=fixture-composition

The same line appears twice, then the JSON report follows. Any consumer that parses the report fails (jq: parse error: Invalid numeric literal at line 1, column 7). The help text says --json prints "a versioned report ... to stdout", so logs belong on stderr.

Asked

1. doctor workspace --naming-scope, read the way run and generate runnable-bindings read it, so the freshness check compares against the scope the bindings were generated for.
2. --json keeps stdout to the report only.

Blocks obin-ai/platform-core#119 (the pins gate). Nothing in that workspace was changed to work around either problem.