feat: add read-only remote capability doctor

[J3m5]

Summary

• add a strictly read-only doctor command with a versioned JSON result and human/GitHub summaries
• inventory the portable remote command profile, optional tools, normalized tar capabilities, and observable root/workdir permissions
• require pinned known_hosts by default, with explicit non-persistent discovery limited to doctor and report
• expose doctor through the composite Action without building an archive
• document the public CLI, result contract, Action workflow, and security policy

Compatibility

• GNU tar 1.34 is the initial implementation/version pair covered by SSH E2E; other versions return undetermined
• doctor never creates the remote workdir or writes a probe file; actual write access remains an apply preflight concern
• no consumer-specific capabilities or private project references are encoded in the public implementation
• the Action path is validated statically and through the locally built PEX; it becomes directly consumable after a release publishes a PEX containing this change

Validation

• mise run check — 91 tests plus Ruff, Pyrefly, Actionlint, Action Validator, whitespace, conflict, and private-key checks
• mise run test:e2e — 15 SSH scenarios, including remote state equality before/after doctor
• mise run test:e2e:pex — 15 SSH scenarios through the distributed PEX shape