S19: teploy-ship doctor install-readiness checks and restore-readiness comparison

[im-tyler]

Changes

• src/install-doctor.ts: install prerequisite checks (Node version, state dir writable and free space, web port, SHIP_WEB_TOKEN and model credential presence without values, NUCLEUS_URL shape, store connectivity, clock sanity/skew). Every check is pass|fail|unknown; unknown is never pass. Verdict is ready only if all pass; not-ready on any fail; incomplete otherwise. Output passes the support RedactionGate.
• New read-only teploy-ship doctor [--json] [--out f] command (exit 0 only when ready). Additive: args.ts flag entry, cli.ts dispatch. No existing command changes.
• src/restore-readiness.ts: pure backup-vs-restored history comparison (per-run event count + digest, waiting decisions, fingerprints, missing/extra/changed). Returns unverified unless it actually compared. Not yet exposed as a command; snapshot capture needs a live store.
• docs/SUPPORT.md: short doctor section.

Checks

• pnpm run lint clean. Isolated node --test "dist/**/*.test.js": 2007 tests passed, 0 failed. New: 13 doctor tests, 7 restore-readiness tests.
• Negative controls (dist mutated, then restored): bypassing redaction in the JSON output, bypassing it in the text output, rounding unknown up to ready, store-connectivity unknown->pass, clock unknown->pass, dropping the digest compare, allowing an empty backup, dropping waiting-decision loss. Each was caught by at least one test (1 to 3 failures per mutation).
• Planted fake secrets (web token, model key, DB password, GitHub token, built at runtime) never appear in JSON or text output.
• Skipped scripts/grader-sensitivity.test.mjs and scripts/*.test.mjs (fixed port 8901 collision between agents; CI runs them). web/ untouched.

Not verified / still open

• Never run on a genuinely fresh supported machine; default probes exercised only on this sandbox.
• Store connectivity and clock-skew reference have no real probe wired (report unknown by default).
• Restore-readiness has no snapshot producer or CLI. Doctor is not yet folded into the support bundle.
• S04 not started.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VqsBNqvaWezf1DwQrAnVgX

---

Generated by Claude Code