doctor should report channel, macOS version, checkout/data overlap, and last PARTIAL

[splaice]

potential-improvement — found while implementing #6, #7, #8, #9.

omacase doctor is the post-install checklist users actually run. It currently checks tools and permissions, but not the new control-plane facts those issues added.

What would help

• macOS product version vs OMACASE_MACOS_MIN ([P2] Enforce the documented macOS 26 minimum #6) — so an older Mac learns why bootstrap/runtime will refuse, in the same place as other grants.
• Checkout vs OMACASE_DATA ([P2] Separate mutable Omacase data from the updater checkout #7) — warn when the git worktree is the data root (old public layout). Theme caches will keep dirtying the updater checkout even with .gitignore.
• Channel + current tag ([Security] Add integrity and version controls to updates and mutable dependencies #9) — stable / dev, git describe, and whether a newer v* exists. Maintainer machines that forgot OMACASE_CHANNEL=dev will otherwise detach onto a tag on the next update.
• Last PARTIAL run ([P2] Return failure when install or update only partially converges #8) — if we persist the ledger (step names + timestamp) under $OMACASE_STATE, doctor can say "last update left brew bundle incomplete" instead of making the user scroll scrollback.

Small, read-only, and it makes the new gates discoverable instead of only aborting later.