feat(cli): doctor checks vendored wasm grammars + scip indexers (--strict)

[theagenticguy]

Summary

Extends codehub doctor so an operator can verify a deployment's full parse + index toolchain, not just node/pnpm/native bindings. Closes the gap where doctor was silent about the two things most likely to make analyze quietly under-perform: missing vendored grammars and missing SCIP indexers.

Builds on the existing doctor framework (same Check interface, ok/warn/fail, exit 0/1/2) — @ladybugdb/core and the scanner binaries were already covered; this adds the missing rows.

New checks

1. Vendored WASM grammars (1 row)
Asserts all 16 blobs ship in @opencodehub/ingestion's vendor/wasms/ with valid \0asm magic — mirrors the prepublish gate verify-vendor-wasms.mjs, but runs against the installed package so it validates a real deployment. Always fail on absence/corruption (never a soft skip — a shipped artifact being gone means parsing is broken).

2. SCIP indexers (1 row per language)
typescript, python, go, rust, java, ruby, c/c++, c#, kotlin, cobol. Probes <bin> --version, ~/.codehub/bin, and JAR assets under ~/.codehub. Hints route setup-installable indexers to codehub setup --scip=<flag> and system toolchains (go/rust/java SDKs) to the user's package manager.

The --strict flag (skip = fail, opt-in)

By default an absent indexer is warn — the analyze pipeline skips an unavailable language gracefully (a Python-only box doesn't need scip-go), matching the lenient runtime behavior. --strict escalates every absent indexer to fail (exit 2) for release/CI gates. Vendored WASMs are fail in both modes.

codehub doctor            → scip-ruby absent = WARN (exit 1)
codehub doctor --strict   → scip-ruby absent = FAIL (exit 2)

This deliberately reconciles with #156: runtime stays lenient; the diagnostic gate can be strict.

Implementation note

The vendor dir resolves via import.meta.resolve("@opencodehub/ingestion"), not createRequire().resolve() — the package's exports map declares only the ESM import condition, so the require form throws ERR_PACKAGE_PATH_NOT_EXPORTED. Caught during testing: the require path only "worked" locally via the monorepo fallback and would have falsely FAILed the WASM check in a real global npm i -g install. The import.meta.resolve path is verified to resolve with a bogus repoRoot (i.e. no monorepo).

Verification

• codehub doctor → new rows render; exit 1 with absent indexers
• codehub doctor --strict → indexer rows FAIL, exit 2; OK indexers (go/rust here) stay OK; wasm stays OK
• 262/262 cli tests pass (8 new: wasm ok/fail, indexer warn-vs-strict-fail, JAR-by-file resolution, exit-code escalation)
• typecheck + biome clean

Test plan

• vendored-wasms ok against real install; fail-capable (never warn)
• indexer warn (default) → fail (--strict) for the same absence
• JAR indexer (kotlin) resolves by file presence
• runDoctor exit code: 1 lenient, 2 strict