feat: doctor warns on multiple active installs

[Ram9199]

Closes #111. Fourth in the founder-dogfood self-identity chain; reuses inventory's classification (#101).

Principle: a permission tool must clearly identify which copy of itself is guarding the user. The dogfood machine had three installs and doctor passed green — the duplicate signal existed only inside agent-sudo inventory, the command a confused user doesn't know to run.

What

One WARN-only check in run_doctor(): single active install. It counts distinct active, non-shim install roots from the inventory report and WARNs on more than one:

WARN: single active install - Multiple active Agent_Sudo installs detected. Run `agent-sudo inventory` to inspect and choose one canonical install.

Reuse, not new detection

Uses inventory's existing ACTIVE / PYENV-SHIM statuses (#101). No new discovery logic:

• a pyenv shim and the version install it resolves to collapse to one (PYENV-SHIM records excluded) — no false duplicate;
• two real installs stay distinct by root, including same-version editables at different source roots.

Scope discipline

• WARN-only — the name isn't in doctor's required set, so the exit code stays 0. No auto-fix, no cleanup/deletion.
• No topology view (that's Topology view: CLI surfaces, MCP clients, audit locations, and not-routed tools #112).

Tests / validation

• New DuplicateInstallCheckTests in tests/test_doctor.py, exactly the four requested cases:
  1. no duplicates → OK
  2. duplicate active installs → WARN (exact message) + exit 0
  3. pyenv shim + resolved install → not double-counted (OK)
  4. same-version editables at different roots → WARN
• Full suite: 493 passed. ruff clean.
• Docs: command_reference.md doctor entry notes the duplicate-install WARN.