Add read-only workspace check and doctor commands

[codeforester]

Summary

Extend the workspace command surface beyond basectl workspace status with read-only workspace-level check and doctor commands.

This follows the product-vision direction that workspace operations should start read-only, support partial failure, and emit machine-readable summaries before Base grows mutating workspace-wide commands.

Scope

• Add basectl workspace check.
• Add basectl workspace doctor.
• Reuse the existing workspace discovery path and --workspace <path> override.
• Support text and JSON output.
• Treat partial failure as normal: one invalid or unhealthy project should be reported without losing the rest of the workspace report.
• Keep both commands non-mutating.

Non-Goals

• No workspace-wide setup, test, or repair behavior in this issue.
• No workspace manifest consumption; that is tracked separately in Design workspace manifest for team-managed repository sets #326.
• No doctor --fix behavior.

Acceptance Criteria

• basectl workspace check reports check state across discovered projects.
• basectl workspace doctor reports actionable findings across discovered projects.
• JSON output is stable enough for CI or automation smoke checks.
• Invalid manifests and missing project state are represented as findings rather than fatal scan-wide failures.
• Bash completion, help text, README/docs, and tests are updated.

Source Design Intent

Curated from the local product vision draft during #392.