fix(doctor): print warnings as warnings, and open a sandbox's banner last (#462)

[edgehero]

Closes #462.

doctor: warnings that printed as passes

render prints ⚠ with a fix only for { ok: false, warn: true }, which never fails doctor's exit code. Twelve checks returned { ok: true, warn: true } and printed a green ✓ with no fix. That is more than the eight the issue listed: four compute ok or warn. Each is now decided on one rule:

• Warning (⚠ with its fix): something the operator configured is broken or does nothing, and they can change it.
  • symlinked skills that are skipped
  • an injected skill whose ai-trigger: allow is never read
  • a broken wait profile no trigger names
  • PI_SESSION_MAX_CONTEXT_PCT
  • a one-shot trigger with PI_TRIGGERS_FILE unset
  • a scoped limit naming a folder no trigger runs in
• Fact line (✓, advice moved into the label): a trade the operator chose.
  • GitLab's api scope
  • PI_SECRET_RESOLVER_ROOTS
  • local secret binding
  • persisted transcripts
  • run.replicas
  • retained workspaces

Every one is pinned through render() with its exact text.

sandbox: the banner after the last refusal

pi-dispatch sandbox <id> printed "opening pi-sandbox-... exit the shell to dispose of it." before refusing with "network already exists". beforeLaunch now runs right before the launch: after the network is created, and inside the try whose finally removes it. A refused open never prints the banner, and the admin panel gets the same order.

Found while verifying #453 and #446 (round ledger)

• Podman's stopped and restarting proxy states read ✗ in doctor, since a crash loop fails every job. A transient stopping stays ⚠. The worker's retry mapping is unchanged.
• up shows only runnable consent lines: a read-only network inspect first, and the create line only when the network is missing.
• A proxy stale on its image, entrypoint or command is offered its replace even while a mount cannot be compared. A mounts-only question with an unknown mount is still refused, and doctor then gives the manual commands.
• A pinned sandbox tombstone held back by a manifest-less directory is restored in the same sweep pass, not the next one.

Specs

DES-CONTAINER-BACKEND-REGISTRY, DES-PODMAN-STACK-AS-QUADLET-UNITS, INT-SANDBOX-CONTRACT, INT-EGRESS-POLICY-CONTRACT, REQ-DEPLOYMENT-BOOTSTRAP.