feat: add read-only Agent Core doctor

[sam2tom]

Summary

• add a redacted, layered pnpm core:doctor command
• require exact HTTP 200 for liveness and authenticated Agents reads
• validate the canonical list, Agent, pagination, and known saved-tool envelopes while allowing additive fields and unknown nonempty tool types
• fail closed without reading or authorizing from token files when owner-only permissions cannot be proven
• report the full pinned Parsar revision and keep tool/Web, full protocol, executor, model, and provider readiness explicitly unknown

Compatibility boundary

The authenticated probe proves only the basic Agent resource envelope. It does not prove that Web supports every returned tool or that the connected Core implements the complete protocol.

Pinned Parsar Agents API contract: 0438880ab21aa16d05cb91a4c7f91cc0abc12358

Validation

• merged and validated against main@d0b4e2f79fd49598ae15be9c346038300ce716b8
• independent final review found and verified the fix for malformed saved MCP envelopes; no P0/P1/P2 findings remain
• focused Core Doctor tests: 63/63 passed
• pnpm check: root 67/67, Agents client 47/47, Web 291/291, typecheck and build passed
• final serial Playwright suite: 36/36 passed; the sole transient loading-state assertion from an earlier concurrent run passed 1/1 in isolation before the full rerun
• git diff --check, conflict-marker, private-state, port-cleanup, and clean-Worktree checks passed
• relative to latest main, the diff is exactly the nine Issue [agent] Add a read-only local Agent Core doctor #12 Doctor paths

Boundaries

• all Core network probes are GET-only and are never automatically retried
• no database or resource write, Session, Turn, paid model call, deployment, service restart, or branch/Worktree cleanup was performed
• no token value, authorization header, provider credential, response body, or private path is included in shareable output
• execution, model, provider, and tool/Web readiness remain Unknown unless a stable upstream contract proves them

Closes #12