refactor(doctor): share deploy path comparison

[gfargo]

Summary

• extend the shared comparison core with filesystem-independent lexical path normalization
• make shallow and deep doctor checks use the same deploy-root containment policy
• reject sibling prefixes such as stacks-old while tolerating repeated and trailing separators

Why

The two doctor VPS inspection paths implemented deploy-root checks independently. The shallow fleet check required a slash boundary, while the deep check used a raw string prefix and could accept /expected/stacks-old/... as if it were under /expected/stacks.

This continues #248 by moving another inspection policy into lib/compare.sh without changing remote collection, output formatting, or doctor exit behavior.

Validation

• full Bats suite: 2,650 tests passed, 2 skipped
• focused doctor/diff/drift suite: 111 tests passed
• direct component-boundary, repeated-separator, trailing-slash, exact-root, and root-path smoke checks
• shellcheck -s bash lib/compare.sh lib/cmd_doctor.sh
• Bash syntax checks
• git diff --check

Advances #248