doctor: let installed agents repair Argus

[lbx154]

What changed

• Turn argus doctor into an active repair command: it launches a locally installed Agent CLI with real tools and Argus-scoped repair access instead of merely returning advice.
• Let the Agent inspect/fix the installation, runtime state, configuration, and dependencies, then run non-recursive deterministic verification.
• Verify after every Agent attempt and feed current remaining findings to the next installed backend when fallback is needed.
• Retry stale configured binaries through PATH and support public backends including Qoder and dsh.
• Require actual tool activity; an Agent that only explains commands does not count as repair.
• Fail Doctor when requested Agent repair is unavailable/unverified; --advisor none remains deterministic-only.
• Keep full repair capability while omitting untrusted logs/raw evidence from the prompt, validating Argus-owned paths, and redacting environment/custom-life-dir vault secrets from prompts, raw Agent I/O logs, and output.

Validation

• Public targeted Doctor/backend/CLI/install suite and Ruff passed.
• Private broad regression suite passed; full non-baseline run reached only a stale generated release identity, then release artifacts were rebuilt and release tests passed.
• Focused Mypy and git diff --check pass.
• Clean macOS uv tool wheel install with real Pi 0.84.1 used tools to create missing house rules/path memory, executed argus doctor --advisor none --verify --json, and returned ok: true with no remaining findings.
• Multiple read-only review passes found and closed fallback, verification, prompt-injection, path-ownership, custom-vault secret, output-redaction, and per-call secret-refresh issues; final review had no remaining blocker.