fix(doctor): stop asserting a version claim it cannot back up, and name the install it is not

[kevintseng]

Summary

Dogfooding the published 4.8.3 found memesh doctor telling the user something false, and staying silent about something worse.

It asserted a version claim it cannot back up. The npm-global install printed [PASS] Update status — Version 4.8.2 is current. at a moment when npm had already published 4.8.3. Doctor never makes a live registry call (deliberately); it reads a cached update-check, and that cache was ~23h44m old — inside STALE_AFTER_MS, so still classified cached rather than stale, so the claim printed unqualified. True when the cache was written, false when doctor read it, and nothing in the sentence let a reader tell the difference. The row now reads "As of the last check (23 hours ago), 4.8.2 was the latest version." — same information, falsifiable.

It could not see that two installs were running different code. The Claude Code plugin was on 4.8.3 and the shell CLI on PATH on 4.8.2 — an agent and the human typing memesh in a terminal running different code against one database. inspectShellCli already resolved the other install's path and reported that the two coexist; it never read that install's version. It now does, via readVersionFromInstalledBinary: follow npm's bin symlink with realpathSync, then walk up a bounded eight levels to the nearest package.json and trust it only when its name matches — a longer or unchecked walk would report an unrelated package's version as memesh's own.

And the stale copy can never fix itself. spawnAutoUpdate derives its channel from whichever copy's hook is executing; hooks are wired to the plugin copy, so the channel is always plugin-marketplace and ~/.memesh/auto-update.log holds 45 consecutive SKIPPED lines — correct for the copy that logged it, silently incomplete for the user, whose npm-global copy is the one that needs a manual memesh update. The npm-global plugin-cache row now says so, and mentions the cached-copy count once it exceeds two.

Type of change

• Bug fix (fix)

Docs synced

• CHANGELOG.md [Unreleased] → ### Fixed
• dist/core/doctor.* regenerated (tracked build output)
• No doctor check inventory or count exists in the docs — check-doc-claims confirms there is nothing to update

Verification

• node scripts/run-tests-isolated.mjs tests/core/doctor.test.ts → exit 0, 159 passed (149 pre-existing + 10 new)
• Mutation (force shellIsBehind null, dist/ rebuilt) → exit 1, 1 failed / 158 passed; restored → 159/159
• npm run lint 0, npm run typecheck 0, check-doc-claims 0, npm run verify:release 0
• Evidence Gates: eg check PASS at base 2d4c0f04 — doctor-install-skew CODE_COMPLETE with a known_bad_mutation failure_path
• On this machine, isolated MEMESH_DIR, the new row fires correctly:

[WARN] Shell CLI on PATH
  `memesh` resolves to …/bin/memesh (separate from this install at …), and it is
  running 4.8.2 — behind this install's 4.8.3. Both share the same DB, but an agent
  using this install and a human typing `memesh` in a terminal are running different code.
  Fix: Run `npm install -g @pcircle/memesh@latest` …

Test plan

CI on this head. After merge, memesh doctor on any machine with both a plugin and a global install will name the skew instead of reporting PASS.