[deploy-plugin DPB-14] Host: doctor-checks as data + installer tooling variant + contributionAxes

[rickylabs]

Part of #892 (RFC #891; corpus .llm/runs/plan-deploy-plugin--seed/ r5).

DoctorCheckContribution { id, loader } resolved through a duplicate-guarded registry (auth's auth-backend check migrates compatibly); installer-protocol officialSource variant { sourceKind: 'tooling' }; capabilities.contributionAxes. v1 service manifests keep parsing. Anti-scope: no closed-union widening; no deploy-specific protocol fields (SF-3/SF-14).

Acceptance

• gate: the auth doctor check migrates with zero behavior change
• gate: schema parse + official copy/install + backward-compat fixtures green

Metadata

Dependencies: none
Delivery shape: installer/doctor protocol generalization