Make local environment failures diagnosable from the CLI

Add a non-interactive doctor subcommand that checks API key reachability, OAuth credential state, config files, git, MCP servers, network access, and system metadata in one structured report. The implementation reuses existing runtime/auth plumbing and adds focused tests for parsing and report behavior.

Also update stale runtime permission-mode tests so workspace verification reflects the current enum model rather than historical Prompt/Allow variants.

Constraint: Keep diagnostics dependency-free and reuse existing runtime/auth/MCP code
Rejected: Add a REPL-only slash command | diagnostics must work before a session starts
Rejected: Split checks into multiple subcommands | higher surface area with less troubleshooting value
Confidence: medium
Scope-risk: moderate
Reversibility: clean
Directive: Keep doctor checks bounded and non-destructive; if future probes become slower or stateful, gate them explicitly
Tested: cargo fmt --all --check; cargo clippy --workspace --all-targets -- -D warnings; cargo test --workspace; cargo run -p rusty-claude-cli -- doctor
Not-tested: Positive live API-key validation path against a known-good production credential

rust/crates/runtime/src/conversation.rs

@@ -408,7 +408,7 @@ mod tests {
                 .sum::<i32>();
             Ok(total.to_string())
         });
-        let permission_policy = PermissionPolicy::new(PermissionMode::Prompt);
+        let permission_policy = PermissionPolicy::new(PermissionMode::WorkspaceWrite);
         let system_prompt = SystemPromptBuilder::new()
             .with_project_context(ProjectContext {
                 cwd: PathBuf::from("/tmp/project"),
@@ -487,7 +487,7 @@ mod tests {
             Session::new(),
             SingleCallApiClient,
             StaticToolExecutor::new(),
-            PermissionPolicy::new(PermissionMode::Prompt),
+            PermissionPolicy::new(PermissionMode::WorkspaceWrite),
             vec!["system".to_string()],
         );
 
@@ -536,7 +536,7 @@ mod tests {
             session,
             SimpleApi,
             StaticToolExecutor::new(),
-            PermissionPolicy::new(PermissionMode::Allow),
+            PermissionPolicy::new(PermissionMode::DangerFullAccess),
             vec!["system".to_string()],
         );
 
@@ -563,7 +563,7 @@ mod tests {
             Session::new(),
             SimpleApi,
             StaticToolExecutor::new(),
-            PermissionPolicy::new(PermissionMode::Allow),
+            PermissionPolicy::new(PermissionMode::DangerFullAccess),
             vec!["system".to_string()],
         );
         runtime.run_turn("a", None).expect("turn a");