feat(doctor): real safe --fix remediations

Replace the no-op `--fix` stub with real, safe, idempotent, reversible
remediations gated per failing probe (spec 13):

- net.shared: create the missing tool-owned external bridge network via
  docker.EnsureNetwork under the flock (compose refuses external nets).
- state.refs: prune stale ledger ref rows for projects with no live
  container via workspace.Reconcile (locks internally; derived rows only).
- fs.xdg: create missing / tighten group-or-world-writable XDG dirs to 0700.
- dns.resolver / trust.host: diagnose-only — the sudo /etc/hosts write and
  the mkcert/NSS trust-store drive are out of --fix by construction; each
  keeps its manual remediation.

Each probe now carries Fixable + a fix + recheck; applyFixes runs ONLY
fixable, non-OK probes, re-probes, and reports fixed/still-failing, updating
the report + exit code to the post-fix state. A passing check's fix is never
invoked; nothing destructive (volume/container/network/db/CA removal) is ever
run. docker.Check gains additive id/category/fixable/fixed JSON fields; the
existing {"checks":[...]} envelope is preserved and gains a "fixes" key under
--fix. --quiet now prints only non-OK lines.

Table-driven tests: failing-then-fixed, non-fixable-left-with-remediation,
passing-fix-never-run, failing-fix-still-failing, mixed matrix, plus wiring
tests for the real net.shared / state.refs / fs.xdg fixes and dirSecure.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: gustavobertoi