feat: doctor flags malformed lockfile lines; harden wget invocation

[Chemaclass]

Context

1. bashdep::doctor only reports missing/orphan; a corrupt lockfile line (not a valid <name>\t<url> pair) is silently ignored by the awk — merge-conflict damage goes unnoticed.
2. _download runs wget -qO "$output" "$url"; a URL beginning with - could be parsed as a flag, and busybox wget differs slightly.

Scope

• doctor: detect and report lines that are not exactly two tab-separated fields (or empty name), counting them as issues.
• _download: pass -- before the URL for both curl and wget; verify busybox-wget compatibility of the flags used.

Boundary

Files: bashdep (doctor, _download), tests, docs/behavior.md, CHANGELOG.md. Two small, related robustness fixes.

Acceptance criteria

• doctor reports a malformed lockfile line and counts it (new test with a corrupt fixture)
• A URL starting with - downloads correctly (guarded by --)
• Existing doctor/download tests stay green

---

Constraints (apply to all bashdep work)

• Bash 3.2+ compatible — no declare -A, ${var,,}/${var^^}, mapfile, negative array index, &>>.
• Zero runtime deps beyond curl/wget/awk/mktemp/mkdir/rm/cp/mv/printf/cat/grep/sort/tr/dirname/basename + shell builtins.
• TDD: write the failing test first (tests/unit/*_test.sh), then implement; keep make test green for the right reason. Mock curl/wget — no network in tests.
• Quality gate: make test && make sa && make lint must all pass.
• Update docs/api.md / docs/behavior.md when public API or semantics change; add a CHANGELOG.md ## [Unreleased] entry for any user-visible change.
• Conventional commits (ref: for refactors); never mention AI/automation. One PR per issue, assigned to Chemaclass.