Doctor reports every optional module with one module-unavailable finding #596

Part of #591.

Scope

Replaces the doctor's agent-device-only finding with one finding kind for
every optional module (ADR 0030 §7). After this PR, simlock doctor
reports a module that is turned on but cannot run as module-unavailable,
with the module's name. The core doctor, the contract's doctor finding
and the CLI's doctor output name no module.

This task runs first in #591. It and #595 both bump the protocol in the
same lines, and it and #597 edit the same main.test.ts tests.

In short

The report simlock doctor prints on stdout, with an agent-device that is
too old.

Before:

{ "findings": [{ "kind": "agent-device-unavailable",
  "message": "found 0.20.3, need 0.21.25 or later",
  "remedy": "install agent-device 0.21.25 or later, then restart the daemon (`simlock daemon stop`, then `simlock daemon start`)" }] }

After:

{ "findings": [{ "kind": "module-unavailable", "module": "agent-device",
  "message": "found 0.20.3, need 0.21.25 or later",
  "remedy": "install agent-device 0.21.25 or later, then restart the daemon (`simlock daemon stop`, then `simlock daemon start`)" }] }

The line simlock doctor writes to stderr does not change:

agent-device  fail  found 0.20.3, need 0.21.25 or later; install agent-device 0.21.25 or later, then restart the daemon (`simlock daemon stop`, then `simlock daemon start`)

If this goes wrong: a module that cannot run is missing from
simlock doctor, or a client on the old protocol misreads the report.

Technical spec

Facts

Modules touched

flowchart LR
  ad["agent-device findings *"] --> core["core/doctor *"]
  core --> contract["contract/schemas *"]
  cli["cli/index *"] --> contract

Surface and extension points

• The core's member becomes
  { kind: "module-unavailable", module: string, message: string, remedy: string }.
  OptionalModuleFinding is that member.
• isDrift leaves out module-unavailable (F3).
• agentDeviceFindings returns it with module: "agent-device".
  • Until agent-device runs as an optional module on workers #597, this line sets agent-device's module. Optional modules load through one host and are turned on under capabilities #595's host stamps
    module on the findings of the modules it loads.
  • agent-device runs as an optional module on workers #597 moves it: the host stamps module from the definition's name,
    which Optional modules load through one host and are turned on under capabilities #595 checks against F14 at start. A bad name then fails the
    start, never the report (F13).
• The CLI's writeAgentDeviceUnavailable becomes writeModuleUnavailable.
  It writes <module> fail <message>; <remedy>, with F7's collapse, cut
  and order. For agent-device the line is unchanged.

Contract and event changes

doctorFindingSchema's member becomes
{ kind: z.literal("module-unavailable"), module: capabilityNameSchema, message: z.string(), remedy: z.string() }
(F4, F14). capabilityNameSchema moves above doctorFindingSchema in
src/contract/schemas.ts, which uses it at load. This PR bumps the
protocol by one. CHANGELOG.md gets a line
under Unreleased: agent-device-unavailable is now module-unavailable
with module.

doctor.reconciled does not change. The finding never enters its
driftFindings (F3). Searched both EVENTS.md files for the kind: no entry
names it.

Other code on the same state

• doctor --fix and the purge act only on drift findings. This finding
  stays out of drift (F3).
• Optional modules load through one host and are turned on under capabilities #595 and agent-device runs as an optional module on workers #597 build on this shape. Both run after this task.

Rules in play

• architecture.md rule 21: the core doctor, the contract's doctor
  finding and the CLI's doctor output name no module.
• testing.md rule 2: F10's not.toContain must look for a kind it could
  see.
• documentation.md: docs/CLI.md (F11).

Tests

Seam: Doctor with optionalModules, modelled on src/core/doctor.test.ts.
Also doctorFindingSchema in src/contract/schemas.test.ts, simlock doctor in src/cli/index.test.ts, and startDaemon → doctor.run in
src/daemon/main.test.ts (F9).

• a doctor run returns each module-unavailable finding optionalModules gives, unchanged
• a module-unavailable finding is not in doctor.reconciled's driftFindings
• doctorReportSchema parses a module-unavailable finding, and refuses one without module, without message or without remedy
• doctorReportSchema refuses a module that fails the capability name check
• doctorReportSchema refuses the old agent-device-unavailable kind
• agentDeviceFindings returns module: "agent-device" with the supervisor's message and remedy when unavailable, and nothing when starting, running or off
• F8's test, for writeModuleUnavailable: simlock doctor writes agent-device fail <message>; <remedy> on stderr, whitespace collapsed, at most 500 characters per part, after the advisory, prerequisite and warm-pool lines (as today)
• simlock doctor writes <module> fail … for a finding of another module
• F9's tests, now asserting { kind: "module-unavailable", module: "agent-device" } through doctor.run: too-old version, command not found, none when off, none while starting
• the protocol version is one above the base branch's

Done when

• Every Tests line passes.
• git grep -n agent-device-unavailable -- src e2e ':(glob)docs/*.md' prints only
  the refusal test in src/contract/schemas.test.ts and the protocol 30
  row of the history table in src/daemon/server.test.ts (F16), which
  stays as history.
• F10's two assertions name module-unavailable. On a Mac with an iOS
  runtime: scripts/slow-e2e.sh e2e/slow-agent-device.test.ts passes.

Out of scope

• Any change to when agent-device is reported unavailable.
• The module host (Optional modules load through one host and are turned on under capabilities #595).
• Accepted ADRs and old drafts under docs/internal, which keep the old
  name as history, and architecture rule 21, which names it as the example
  of what a host must not know.

Depends on

Written by an agent.