feat: add ataegina doctor --json (structured diagnostics)

[noahhyden]

What & why

doctor already gates via its exit code (nonzero on a hard [fail]), but an agent doing health-based remediation wants to know which check failed, not just pass/fail. doctor --json emits a structured report:

{"status":"pass","summary":{"ok":6,"warn":2,"fail":0},"checks":[{"level":"ok","message":"worktree: index #0 …"}, …]}

• Human [ok]/[warn]/[fail] lines and the urls/hook chatter go to stderr; stdout is pure JSON.
• status mirrors the exit code (fail iff a hard [fail]).
• dok/dwarn/dfail now also record each row, so a config-defined ate_doctor hook that calls them is captured in the report — and a hook calling dfail flips status to fail and the exit code nonzero (a real, tested path, since nothing in the built-in checks fails by default).
• Plain doctor is unchanged.

Discipline

• Spec: docs/design/agent-native.md (§6).
• Tests-first: tests/doctor_json.bats — 7 hermetic tests: stdout purity (stdout/stderr captured separately), summary counts == len(checks), the none port-tool warn row, a failing ate_doctor hook flipping status+exit code (and its dok/dfail rows captured), human-output regression, arg validation, completion. doctor.bats regression clean.
• Live verification: drove the binary; parsed the report with python -m json.tool; confirmed exit 0 healthy and the hook-fail path.
• Mutation red-teaming: status-always-pass, drop-stdout-restore, and _doctor_record no-op — each caught.
• Docs: README, man page, CHANGELOG, bash+zsh completion, in-script --help. Checksum regenerated.

Rounds out the read-only JSON surface (ports/status/list/doctor) alongside #27–#31.

🤖 Generated with Claude Code