rulesync doctor: input-tree and workspace check groups (follow-up to #2446)

[dyoshikawa]

Background

#2446 proposed a rulesync doctor command with three check groups. PR #2491 shipped the first slice: the command itself plus the full config-file check group (unknown/misspelled keys with did-you-mean, unknown targets/features, deprecated ignore, targets/features exclusivity including base+local merge, conflicting target pairs, $schema presence/currency, structural schema violations, tokenEnv env-var presence, inputRoot existence), with --strict, --json (diagnostics in data on success and in error.details on failure), unit + e2e coverage, and docs.

This issue tracks the remaining check groups and follow-ups deliberately left out of that slice.

Details

Input tree checks (.rulesync/**)

• Input root exists and is non-empty; warn when missing entirely (user probably never ran rulesync init).
• Rules: frontmatter validity, exactly one root rule where that matters, valid targets / globs.
• Commands, subagents, skills: frontmatter validity; skill directories missing SKILL.md.
• .rulesync/.mcp.json against the generated mcp-schema.json, and the permissions file against permissions-schema.json — including unknown-key detection.
• Dead input files no enabled feature will read, reported as info.
• Fold in warnings from the adapter import-leniency/sanitization paths (cline description repair, junie rule-set sanitizer) as doctor diagnostics.

Workspace checks

• Generated outputs stale relative to inputs (reuse the --check machinery, reported as one diagnostic).
• Expected .gitignore entries missing (derived like gitignore-derive.ts).
• Output files that no longer correspond to any input.

Other follow-ups from #2446

• --fix for the auto-fixable subset (missing $schema, missing gitignore entries).
• Consider making ConfigFileSchema strict (or warn at load time) so plain generate also stops silently ignoring unknown keys.
• Expose doctor through the MCP server.
• Honor --targets / --features scoping once checks exist that meaningfully scope by them.

Solution / Next Steps

Extend src/cli/commands/doctor.ts's diagnostic collector with the new check groups, reusing each feature class's fromFile validation and the generated JSON schemas rather than duplicating rules. Keep per-check unit tests plus broken-fixture e2e coverage, mirroring the structure established in PR #2491.