fix(doctor): scope checks and group actionable output

[solomonneas]

Summary

• Carry explicit target or operator scope with every check after doctor aggregation.
• Remove scope inference based on check names.
• Show only FAIL, WARN, and MANUAL target findings by default, grouped under severity labels.
• Keep --operator for host findings and --full for OK and INFO detail.
• Preserve legacy three-field station checks and make brigade status accept optional scope metadata.

Closes #556.

Scratch workspace reproduction

The same initialized scratch workspace was checked against current main and this branch on a host with operator state.

Before

Current main printed 51 lines with 44 visible target checks because the old condensation threshold was 50:

$ brigade doctor --target <scratch-workspace>
brigade doctor: target <scratch-workspace>
  scope: target workspace only (pass --operator for host-global checks)
triage: 44 checks, 31 ok, 10 warn, 0 failed, 2 manual, 1 info

  [ok]   ...
  [warn] ...
  ...
summary: 44 checks, 0 failed, 2 manual

After

The default report is 16 lines with six actionable target findings:

$ brigade doctor --target <scratch-workspace>
brigade doctor: target <scratch-workspace>
  scope: target workspace only (pass --operator for host-global checks)
triage: 43 checks, 36 ok, 6 warn, 0 failed, 0 manual, 1 info

warnings:
  [warn] bootstrap: CLAUDE.md
  [warn] memory-care: scan-latest
  [warn] memory-care: refresh-queue
  [warn] security: config
  [warn] security: evidence bundle
  [warn] security: evidence ignored

showing 6 actionable checks; run `brigade doctor --full` to show all checks

summary: 43 checks, 0 failed, 0 manual

--operator --json reports 43 target checks and nine operator checks. Text output places the visible host findings under:

operator/host (not specific to this target):
warnings:
  [warn] graphtrail (code graph) ...
manual actions:
  [todo] components: graphtrail ...
  [todo] components: graphtrail-mcp ...
  [todo] components: miseledger ...
  [todo] components: sessionfind ...
  [todo] managed tools ...

Verification

$ brigade work verify run --target . --command "./scripts/verify" --capture brigade-work
run: 20260726-212344-work-verify-ff41e0
status: completed
commands: 1
- ./scripts/verify [completed] exit=0

The full gate passed 4,355 tests with three expected skips and 82.82% coverage.

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• coderabbit-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: escoffier-labs/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 03cc5c56-d827-4525-b2f7-07154fec1b3a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/doctor-workspace-scoping

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}