feat(doctor): Docker environment readiness pre-checks (#28)

[PeterGuy326]

Summary

doc#28 — Docker environment readiness pre-checks. doc doctor now reports Docker daemon readiness with a stable code and actionable guidance, and doc up refuses to start the stack before that verdict passes (pre-effect ordering). Detects the two known Windows/WSL traps surfaced by ops dogfood (2026-08-29), so a broken Docker environment fails with an actionable message instead of dying mid-up.

Requirement trace (doc#28)

REQ/AC	Change	Evidence
REQ-001 / AC-001	docker-readiness.js checkDockerReadiness() returns docker_daemon_unreachable + guidance; surfaced in doc doctor	AC-001: daemon down -> docker_daemon_unreachable with actionable guidance test
REQ-002 / AC-002	hasDesktopExeCredsStore() detects credsStore: desktop.exe on a non-Windows host (and exec-format stderr), returns docker_credsstore_desktop_exe + remediation; native Windows not flagged	AC-002: credsStore desktop.exe under WSL, AC-002: ... native Windows is not flagged, AC-002: exec-format error ... diagnosed tests
REQ-003 / AC-003	doc up runs the readiness verdict before the first pull/build and returns failure without invoking docker ... up	AC-003: doc up fails ... before invoking docker up (no side effects) tests

Files

• packages/cli/src/docker-readiness.js — new module: checkDockerReadiness() (stable code + guidance), hasDesktopExeCredsStore(), DOCKER_READINESS_CODES. Read-only (no daemon start, no pull).
• packages/cli/src/doctor.js — docker-daemon check now reports the readiness verdict with code + guidance; check() carries optional code/guidance.
• packages/cli/src/cli.js — doc up pre-effect readiness gate; formatDoctorText renders guidance; runDoctor gains injectable homeDir.
• packages/cli/test/docker-readiness.test.js — 8 tests (daemon-down, credsStore trap incl. native-Windows negative + exec-format diagnosis, doc up ordering).
• packages/cli/package.json — check adds src/docker-readiness.js.
• docs/RUN_LOCAL.md — Docker readiness section; CHANGELOG.md entry.

Validation

• node --test (packages/cli): PASS 58/58 (incl. 8 new doc#28 tests).
• npm run check (packages/cli, syntax across all CLI sources incl. new module): PASS.
• Docker readiness detection itself is read-only and exercised by the fixtures above; live Docker/Desktop behavior is ops-verified input, not re-run here.

Security and compatibility

• No credential, secret, or personal data touched; detection reads only Docker client state and ~/.docker/config.json.
• No new dependency. No change to image composition or Compose topology.
• Detection never starts the daemon or pulls; it only reads.

Known limitations

• Live Docker Desktop / WSL behavior is evidenced by ops reproduction logs (docker_cfg_fix.log), not re-run in this PR.

Risk and rollback

Additive pre-check; rollback reverts the commit. No data migration, no irreversible effect.