feat(doctor): add verified repair pipeline

[Chenxxxxxx06]

Summary

Add a cross-platform Doctor and verified Repair pipeline for source, editable, wheel, frozen, CLI, Web, daemon, and Windows Desktop deployments.

Doctor remains read-only by default. Repair executes only registered actions, revalidates target identity immediately before mutation, persists plans and append-only outcomes, reruns verification, remembers canonical runtime paths, and requires explicit authorization for environment changes or external publication.

Commands

argus doctor
argus --doctor
argus -doctor
argus -doctor --fix-safe
argus repair --plan --json
argus repair --safe
argus repair --apply <PLAN_ID> --yes
argus repair --prepare-pr <PLAN_ID>
argus repair --submit-pr <PLAN_ID> --yes
argus-doctor --root <checkout> --json
argus-doctor --root <checkout> --repair-install --yes
argus-doctor --root <checkout> --repair-desktop --yes

Capabilities

• Typed findings with stable codes, scopes, severity, evidence, and registered action IDs.
• Detection for host/install mode, Python, Node, Git, PowerShell, release assets, Desktop runtime/logs, Web listener state, backend readiness, daemon health, stalled/drain-stuck work, stale PID/control files, and path memory.
• SAFE, CONSENT, and MANUAL authorization tiers.
• Persisted plans under ARGUS_SKILL_HOME/repairs/plans/.
• Target fingerprints and per-action precondition revalidation.
• Idempotent application and interrupted-plan reconciliation.
• Before/after verification; an action cannot claim success when its verification code remains unresolved.
• Sanitized append-only repair history and PR-support reports.
• PR submission refusal unless explicitly authorized, on a clean non-main branch with registered committed repair changes and authenticated GitHub CLI.
• Standalone standard-library bootstrap diagnostics and explicit install/Desktop repair for cases where Argus Core cannot import.
• Authenticated read-only GET /api/system/doctor for Web/Desktop support.

Safety boundaries

• No execution of recommendation text.
• No automatic credential changes.
• No automatic sudo/UAC elevation.
• No termination of unknown processes.
• No automatic Git reset, stash, merge, rebase, main-branch commit, or force push.
• No external publication without explicit confirmation.

Validation

All local checks pass on native Windows 11 x64:

• Ruff across argus_skill, tests, Desktop, and standalone Doctor
• Windows core/portable/daemon/CLI/WebAPI regression suites
• Doctor/Repair unit, security, idempotence, reconciliation, blockage, and redaction tests
• Existing changed-module regression suites
• Web: 28 files / 191 tests, typecheck, production build, audit 0
• TUI: 274 tests, production bundle, audit 0
• Desktop: 32 process/identity/recovery tests, typecheck, build, audit 0
• Release manifest/event types/Web/TUI artifact consistency
• PyInstaller frozen backend provider/module/script/timezone verification
• Unsigned Windows package layout
• Source Doctor SAFE -> plan -> authorized apply -> final blocking=[] E2E
• Default Doctor completes in approximately 2.1 seconds
• Frozen Doctor reports frozen_install and completes SAFE repair
• Packaged Desktop authenticated /api/system/doctor E2E
• Sensitive filename, token-like addition, and prohibited-marker scans

Checklist

• No sensitive data added
• Existing runtime behavior preserved
• Generated artifacts refreshed
• Repair actions are closed and typed
• Mutations require the documented authorization tier
• Failures remain visible and never claim false success