Add module_health.sh: environment health checks beyond security

[rolfsormo]

What

A new module (separate from module_security.sh) focused on general dev-environment
health/performance issues, not just security hygiene. devboost doctor should surface
these; some may be safe to auto-fix via devboost fix <check> if the user asks.

Motivation

While debugging a slow zsh startup on a real machine this session, we found several
issues devboost didn't previously catch, none of which are "security" per se:

• conda shell.zsh hook eagerly initialized on every shell start (~70% of startup
  time in the case we measured) — should be lazy-loaded instead.
• Two zsh plugin managers active at once (see #znap-vs-zinit issue) — redundant work,
  slower startup, potential keybinding/completion conflicts.
• ~/.zshrc sourcing ~/.zshrc.devboost twice (fixed in the zsh module + security
  doctor check as of the "double-sourcing" fix, but this is really a "health" check,
  not a security one — may want to move it here once this module exists).
• Multiple stale .zcompdump* completion cache files accumulated across hostnames/
  machine-name changes over time — can cause compinit to do extra work or rebuild
  unnecessarily.

Proposed checks (starting set — expect to grow)

• conda (and similarly: nvm, rbenv, pyenv, sdkman) eager shell hooks that could be
  lazy-loaded instead
• multiple zsh plugin managers active (oh-my-zsh, zinit, antidote, zplug, znap)
• stale/orphaned .zcompdump* files (especially ones tied to old/renamed hostnames)
• duplicate PATH entries
• .zshrc/.zshrc.devboost double-sourcing (candidate to move from security)
• research: what other common dev-setup slowdowns/misconfigurations should we detect?
  (large history files without HIST_SIZE caps, uncompiled zsh functions when zcompile
  would help, slow compinit -u on every launch instead of caching the check, etc.)

Design notes

• Each check: a small function with a name, severity, human-readable finding, and a
  fix-hint (and optionally an auto-fix function).
• devboost doctor lists all findings, same as today's security doctor checks.
• Consider whether devboost fix <check-name> should exist for auto-fixable ones —
  needs its own confirm-before-destructive-action treatment, same as
  migrate-from-oh-my-zsh --yes.
• Non-goal: auto-fixing anything without explicit user action, consistent with
  devboost's existing philosophy (see AGENTS.md).