feat(miner-hands): CLI-subprocess driver preflight/doctor check (binary + auth detection)

[JSONbored]

gittensory-miner doctor (dispatched in packages/gittensory-miner/bin/gittensory-miner.js:33-35, explicitly documented as a "strictly local, offline command... NO network calls") already runs a fixed array of checks via runDoctorChecks (packages/gittensory-miner/lib/status.js:117-136): node-version, engine-resolves, state-dir-writable, checkLaptopStateSqlite, checkDockerPresent. Once the CLI-subprocess driver (#4266, this batch) exists, doctor should also be able to tell an operator whether the claude/codex binaries it needs are actually on PATH and authenticated — today doctor has no idea those binaries exist at all.

Deliverables

• New check functions (checkClaudeCliPresent/checkCodexCliPresent or similar) added to the array runDoctorChecks returns (packages/gittensory-miner/lib/status.js:121-135), each following the exact { name, ok, detail } shape every existing check already returns.
• Binary detection reuses findExecutableOnPath (packages/gittensory-miner/lib/laptop-init.js:71, already used by checkDockerPresent at :87-96) rather than a new PATH-search implementation.
• Auth detection mirrors the checks each provider already performs at call time: createClaudeCodeAi throws claude_code_no_oauth_token when parentEnv.CLAUDE_CODE_OAUTH_TOKEN is absent (src/selfhost/ai.ts:788); createCodexAi's assertCodexAuthConfigured checks the auth file at resolveCodexAuthPath(env) is readable (src/selfhost/ai.ts:438-448). The doctor check should surface the SAME conditions proactively (read-only, no network) rather than requiring an operator to run a real attempt and read the resulting exit code to discover their CLI isn't authenticated.
• Match checkDockerPresent's "optional, not fatal" tone (detail: dockerPath ? ... : "not installed (optional for laptop mode)", ok: true even when absent) if only one of claude/codex needs to be present, vs. a hard ok: false if the miner's configured driver provider (feat(miner-hands): CodingAgentDriver factory + provider-style config resolution #4289's factory) specifically requires one that's missing — decide which behavior fits and document it, don't just copy Docker's fully-optional tone by default.
• Tests for: binary present + authed, binary present + not authed, binary absent entirely, mirroring the existing checkDockerPresent/checkLaptopStateSqlite test coverage style.

References

• packages/gittensory-miner/bin/gittensory-miner.js:22-35 (doctor dispatch, offline-only contract)
• packages/gittensory-miner/lib/status.js:117-136 (runDoctorChecks — the exact array this issue adds entries to)
• packages/gittensory-miner/lib/laptop-init.js:71-96 (findExecutableOnPath, checkDockerPresent — the binary-detection pattern to reuse)
• src/selfhost/ai.ts:788 (CLAUDE_CODE_OAUTH_TOKEN check inside createClaudeCodeAi)
• src/selfhost/ai.ts:438-448 (assertCodexAuthConfigured)
• Depends on feat(miner-hands): CLI-subprocess CodingAgentDriver (reuse SpawnFn/redactSecrets/EFFORT_TIMEOUT_MS pattern) #4266 (this batch) for which binaries/auth this check targets; loosely coordinates with feat(miner-hands): CodingAgentDriver factory + provider-style config resolution #4289's driver factory for "which provider is actually configured" context

[linear-code]

JSO-3291