feat: doctor warns on stale installs and editable source drift

[Ram9199]

Closes #110. Third in the founder-dogfood self-identity chain; builds on SelfIdentity (#108) and inventory classification (#101).

Principle: a permission tool must clearly identify which copy of itself is guarding the user. doctor previously ran six green checks while a stale v0.5.5 snapshot was guarding the user — it never noticed the running code was behind, or that an editable install had drifted from its source.

What

Two WARN-only checks added to run_doctor():

• install up to date — running version vs inventory's newest_version. WARNs when an older copy is resolving ahead of a newer install, and names where the newer one lives:

  WARN: install up to date - running 0.5.5 but 0.5.6 is installed at /Users/dev/Developer/Agent_Sudo;
        your shell is resolving an older copy — run `agent-sudo inventory` and reinstall or re-point to the newest
  

• runtime matches install source — for editable installs, verifies the running package path still lives under its registered source; WARNs on drift (source moved, or a stale copy shadowing it).

Scope discipline

• WARN-only: neither name is in doctor's required set, so the exit code is never affected and nothing is auto-fixed (explicit doctor detects stale installs and runtime mismatches #110 constraint).
• Reuses SelfIdentity and inventory's newest_version / _version_key rather than re-deriving versions.
• identity and inventory_report are injectable into run_doctor(...) for deterministic tests.

Tests / validation

• New InstallHealthCheckTests in tests/test_doctor.py: stale pinned install (WARN + exit 0), editable source mismatch (WARN + exit 0), clean current install (both OK), plus unknown-version no-warn and a default-presence check.
• Full suite: 489 passed. ruff clean.
• Docs: command_reference.md doctor entry notes the new WARN-only checks.