Make setup verification contention-safe and plan-specific - #26

Description

Setup previously ran the general-purpose doctor after applying its plan. Doctor required BEGIN IMMEDIATE, so an unrelated corpus writer could make a completed installation exit as failed. The verifier then replaced the failed check with required installation checks failed.

Make setup verification specific to the state it just applied:

• verify the installed command, current schema, database integrity, Git, and the exact selected MCP registrations;
• do not treat another process holding SQLite's write lock as an installation failure;
• report failed checks with their redacted diagnostics;
• report changed MCP registrations through restart_clients so active client sessions can replace older runtime processes.

Doctor now separates required database integrity from optional write availability. doctor --strict provides a non-zero exit for automation when required checks fail. Corpus open also compares Goose's current and target versions and rejects a database schema newer than the running binary supports.

The contention regression holds a separate BEGIN IMMEDIATE transaction while setup and doctor run. Setup completes, while doctor remains healthy and reports an immediate database_write warning. Additional tests cover future-schema rejection, busy-timeout restoration, missing/non-executable commands, exact MCP launcher matching, restart reporting, and strict doctor exits.

Testing Done

• go test ./...
• go vet ./...
• go test -race ./internal/app ./internal/corpus
• Windows amd64 test-binary compilation for internal/app and internal/cli
• macOS arm64 test-binary compilation for internal/app
• gofmt and git diff --check

Checklist

• Focused regression tests added for setup verification, contention, schema compatibility, and client lifecycle behavior
• Storage invariants preserved; no corpus data model or write ordering changed
• No new third-party types exposed outside adapters