feat(cli): add ctxguard doctor command

[Ismail-Rhoulam]

Summary

• Adds ctxguard doctor [path] [--json], a follow-up to the ctxguard init flow that verifies the local install actually works end to end:
  • ctxguard resolves on PATH (what the hooks registered by ctxguard init invoke at runtime, as opposed to plugin-mode hooks which call python3 directly)
  • the resolved binary's version matches the one running the check (catches stale/shadowed installs)
  • .claude/settings.json has both PreToolUse and SessionStart hooks registered, with the expected matcher
  • .ctxguard.toml parses cleanly if present
  • a real end-to-end invocation of the PreToolUse hook succeeds (not just static checks)
• Each check reports ok/warn/fail; only fail affects the exit code, so e.g. a missing .ctxguard.toml (defaults apply) or a narrower-than-expected matcher surface as visible warnings without blocking CI.
• This was flagged as a stretch goal in the original build (closing the gap where a pip install into an unactivated venv silently leaves the hooks unresolvable, since ctxguard fails open by design and won't say anything).

Test plan

• pytest: 192 passed (10 new tests: nothing-set-up, fully-healthy end-to-end via the real installed binary, narrow-matcher warning, malformed-TOML failure, missing-dir exit code, rich report rendering)
• Self-scan (ctxguard scan .) returns findings only under tests/fixtures/
• ruff check clean on changed files
• Manually verified all three states (nothing set up, fully healthy, warn-only) with both the rich and --json output