doctor: iterate all identifiable agents (keys dir) for verified-read sections — complete one-shot check

[tps-flint]

Ask

flair doctor currently runs its verified-read sections (Migrations state, Fleet presence) only when --agent <id> is passed:

  Migrations
  ℹ Pass --agent <id> (with a matching key in ~/.flair/keys) to see migration state — requires a verified read

But doctor already enumerates the keys directory (✓ Keys found: 1 agent(s) in ~/.flair/keys) — it can identify every agent it could check. A complete one-shot run should iterate them.

Proposal

• Default behavior: for each key found in ~/.flair/keys, run the verified-read sections as that agent, rendered as a per-agent subsection. On a typical personal install that is exactly one agent (local) — zero added friction, and the migration state that today hides behind a flag (e.g. the Migration disk-headroom floor blocks trivially-small migrations on normally-full personal disks (need 220KB, have 18.6GB, halted) #720 halted-migration warning) shows up in the default run.
• Multi-key machines get one subsection per agent; a failing/unregistered key reports as that agent's finding and does not abort the others (failure isolation per agent).
• --agent <id> becomes a filter, unchanged semantics otherwise.
• Instance-level checks (server up, version handshake, config, embeddings probe, client integrations) still run once, not per agent.

Surfaced during day-one 0.22.0 dogfooding: the halted embedding-stamp migration (#720) was visible in flair status --agent local but invisible in the default doctor run that the same user ran minutes later.