v0.84.0 — the host can contribute checks to cbox-id:doctor

Added

cbox-id:doctor now runs checks the host application registers.

The doctor knows what the library needs — extensions, a crypto key, signing keys, an issuer that resolves. It cannot know what the host needs, and the host's misconfigurations are the ones that fail quietly: a deployment claiming a shape it cannot serve still boots, still answers, and degrades behaviour with no error anywhere.

A host implements Console\\Contracts\\HealthCheck and adds it to the HealthChecks registry from a service provider. One command rather than a second health command — two things to remember to run means the one nobody runs is the one holding the finding.

Results are a typed HealthResult (ok / warn / fail, plus a label and the fix) rather than a string-keyed array, because this crosses a package boundary now.

A check that throws is reported as a failure and the rest still run. The contract forbids throwing; the registry assumes it happens anyway, because the moment you most want a health report is when something is already broken enough to throw.