feat(doctor): v0.4 Phase 1 — --fix + --extensive flags

[TechAlchemistX]

Summary

v0.4 Phase 1 lands per build-plan-v0.4: two operationally load-bearing flags on secretenv doctor.

• --fix — when a backend reports NotAuthenticated, shell out to the canonical remediation CLI (aws sso login, op signin, gcloud auth login, az login, vault login) with inherited stdio so the user can complete interactive auth (SSO browser, MFA, password). Re-runs check() after all remediation attempts; surfaces an audit trail (which command, exit success, any spawn-error) in a new Remediation actions human section + fix_actions JSON array.
• --extensive — Level 3 depth probe. For each Ok backend, reads every [registries.*] source served by that backend instance and runs Backend::check_extensive(uri). Renders alias counts (or read failures with the underlying error) per source under the backend's tree node, and serializes into a backends[*].depth JSON array. Source URIs are deduped across registries.
• The two flags compose — doctor --fix --extensive first remediates, then probes depth against the post-remediation backend set.

run_doctor now takes a DoctorOpts struct (vs three positional booleans) so future Phase 2+ knobs grow the struct, not the signature. Default impl preserves existing setup-embedded doctor behavior.

Tests

• +11 doctor unit tests in crates/secretenv-cli/src/doctor.rs: remediation_argv lookup table (3 tests), Remediation actions render path + spawn-error path, fix_actions JSON shape, depth probe block + plural form + read-failure path, depth JSON array (depth_status discriminator + entry_count + error), and omits-when-empty keys for both fix_actions and depth (preserves the v0.3 default JSON contract for non---fix/--extensive consumers).
• +5 CLI integration tests in crates/secretenv-cli/tests/cli.rs: --extensive happy path (human + JSON), --fix no-op behavior, --fix --extensive composition, --help flag-discovery lock.
• Workspace total: 458/458 (was 442; +16). fmt + clippy -D warnings + deny + audit clean.

Test plan

• cargo test --workspace — 458/458 green
• cargo fmt --all -- --check — clean
• cargo clippy --workspace --all-targets --all-features -- -D warnings — clean
• cargo deny check — advisories ok, bans ok, licenses ok, sources ok
• cargo audit — no advisories
• CI to confirm cross-platform parity

Out of scope

Live-backend integration smoke (against /tmp/secretenv-test/) is deferred to the v0.4 Phase 7 closing audit per the aggregate-release posture — Phase 1 work is mock-validated end-to-end. The 1Password/AWS/GCP/Azure/Vault remediation argv is locked by remediation_argv_known_backends against the canonical static table.

🤖 Generated with Claude Code