feat(doctor): --offline-probe to certify the offline build closure

[jwinarske]

Adds the certification gate that proves a cross target can build with zero network — the last major piece of the offline fence (#98/#100/#101/#102).

What

emb doctor --offline-probe --target <name> [<project>] certifies a target's offline build closure is materialized, without running a build:

• resolves the toolchain + sysroot from the store with the network denied (fails closed on a miss);
• confirms each build: cargo module is vendored;
• under --strict, that a network namespace is available (what emb cross --offline-strict needs).

It checks inputs only, so it stays a seconds-scale gate for CI to run right after emb fetch and before the network is cut. A missing input exits non-zero with the fix (emb fetch). --json emits the verdict as a {host, offline_probe} envelope.

emb fetch . --target rpi5                      # online
emb doctor --offline-probe --target rpi5 .      # gate: is the closure complete?
emb cross . --target rpi5 --build --offline      # build, no network

Structure

New lib/src/cross/offline_probe.dart holds the pure ProbeCheck/OfflineProbe verdict types (aggregation + toData); doctor orchestrates the checks reusing CrossProject.selectTarget, CrossProvider.forTarget(offline: true), CargoVendor.locate, and netnsAvailable.

Test

• dart analyze lib test clean; dart format --set-exit-if-changed clean.
• New offline_probe_test.dart (verdict aggregation, toData); doctor_command_test.dart gains a --offline-probe group (native passes, unknown target → usage, json envelope).
• Full suite: 519 pass, 2 skip, 2 pre-existing real dpkg-deb/real debugfs env failures.

Docs

README emb doctor section documents --offline-probe/--strict, cross-linked from Offline builds (gate on it in CI after fetch).

Follow-up

• Cache the probe verdict keyed on package version + config, for the heavier hooks hermeticity probe later; the input-completeness probe here is already fast enough to run live.