feat: add creed doctor command (COD-387)

[shivros]

Summary

Implements COD-387: creed doctor — a diagnostic command for resolving common setup failures.

Changes

• internal/service/doctor.go (new): DoctorReport type + Doctor() implementation that produces a structured diagnostic report covering:
  • Project root (absolute path)
  • .creed/ directory presence
  • manifest.yaml presence
  • Canonical validation summary (reuses existing Validate() logic)
  • Configured/enabled target state
  • Git availability (reported as info for local sources, error only for git sources)
  • Source type and remote URL (with embedded credentials redacted)
• internal/service/service.go: Added Doctor(ctx) (DoctorReport, error) to the Service interface
• internal/codegen/main.go: Added Doctor case to the CLI handler generator with concise formatting + boolMark helper
• Generated surfaces: CLI (cmd/gen/doctor.go), MCP (internal/mcp/gen/doctor.go), HTTP handler, operation descriptor — all produced by go generate ./...
• Tests: 5 test cases covering healthy project, missing setup, invalid manifest, credential redaction, and edge case (.creed is a file not a directory)

Review Panel

Both reviewers (GPT-5.6, Gemini 3 Flash) flagged a critical credential-leak bug: SourceRemote was set verbatim from the manifest, leaking embedded URL passwords. Fixed before PR: redactRemoteURL() now strips passwords while preserving username and host. Reviewers also confirmed all CI gates pass and the hexagonal/codegen flow is correct.

Verification

All gates pass:

• go generate ./... ✅
• scripts/check-generated.sh — "generated code is current" ✅
• go build ./... ✅
• go test -race -count=1 ./... ✅ (all 15 packages)
• go vet ./... ✅
• gofmt -l . ✅
• CLI smoke test: creed doctor on fresh dir → exit 1 with errors; after creed init → exit 0 with "All checks passed" ✅

Closes COD-387

[shivros]

🤖 Automated Review Panel

GPT-5.6 (openai/gpt-5.6-terra)

Verdict: Request changes — one critical security bug found and fixed.

🔴 Critical (FIXED): SourceRemote was set verbatim from manifest.Source.Remote, leaking credentials embedded in the URL (e.g., https://user:password@host/repo.git). The existing test only covered WithGitToken(), not embedded URL credentials. Fixed in this PR: redactRemoteURL() now strips passwords via net/url parsing while preserving username and host. Test strengthened to cover https://ci-user:hunter2@host form.

✅ Verified:

• All CI gates pass: build, race tests, vet, gofmt, check-generated
• Compile-time interface assertion (var _ Service = (*Implementation)(nil)) covers Doctor
• Hexagonal/codegen flow correct: operation starts at Service, surfaces generated
• Git-missing handling correct: info for local sources, error only for git sources
• Generated surfaces (CLI/MCP/HTTP) all consume the same DoctorReport struct

🟡 Minor: Validation warnings are invisible in CLI output (only errors printed). The structured MCP/HTTP surface includes them. Nice-to-have, not blocking.

---

Gemini 3 Flash (google/gemini-3-flash-preview)

Verdict: Block merge on the SourceRemote credential leak (same finding as Reviewer A). Fixed before PR opened.

✅ Strengths:

• Core diagnostic logic is sound — presence checks, validation, targets, git availability all correct
• Edge cases handled: .creed as file, unreadable dirs/manifest
• AC compliance: missing git is info for local sources (not a false sync failure)
• Generated-code flow followed: descriptor registered, regeneration is a no-op
• Same DoctorReport backs all three surfaces

Cross-referenced: gitremote.sanitizeRemoteURL confirmed as precedent for URL credential stripping. Service-local redactRemoteURL is the correct approach (no adapter coupling).

[shivros]

Auto-Merge Gate Approval

Confidence: 0.92
Ticket: COD-387 — creed doctor — environment and target diagnostics

Rationale

The PR fully satisfies all five acceptance criteria in COD-387:

1. creed doctor reports manifest/source health, validation summary, and configured targets ✅
2. Missing git reported as info for local sources, error only for git sources ✅
3. Sensitive values redacted via redactRemoteURL() — tested with hunter2 password and secret-token-do-not-leak token ✅
4. CLI, MCP, and HTTP surfaces all consume the same DoctorReport struct ✅
5. All gates pass: go generate, check-generated.sh, go test -race, go vet, gofmt ✅

Review Panel Outcome

Both reviewers (GPT-5.6, Gemini 3 Flash) identified a credential-leak bug in SourceRemote. The bug was fixed before the PR was opened — redactRemoteURL() strips passwords while preserving usernames, with regression tests covering both URL-embedded and token-based credentials. No unresolved blocking comments.

Checks Observed

• Test: SUCCESS
• Lint: SUCCESS
• Secret Scan: SUCCESS

Scope

12 files changed (+597, -1). New doctor.go implementation + generated CLI/MCP/HTTP surfaces + tests. No secrets, auth, deployment, billing, or destructive changes.

---

Auto-merged by CodeFold Auto-Merge Gate (confidence ≥ 0.80)