feat(doctor): report whether the running proxy has the docker socket mounted

[mhenrixon]

Summary

kamal doctor now inspects what the running kamal-proxy was actually booted with, not just what the config says. The config-time sleep/docker_socket pairing check can't see a proxy booted before the socket was added (sleeping services never wake — one hung request) or after it was removed (root-equivalent host access lingers).

• Kamal::Commands::Proxy#mount_destinations — docker inspect, one mount destination per line
• New per-host doctor row "Proxy docker socket":
  • OK — configured socket is mounted; or proxy not running (arrives on boot); or nothing configured/mounted
  • FAIL — sleep: configured somewhere and the running proxy lacks the mount → kamal proxy reboot
  • WARN — socket configured without any sleep: and not mounted (drift, nothing hangs yet); or a docker.sock mount the config no longer asks for; or the inspection itself failed (the doctor never crashes)
• Latent bug fixed in path: the doctor's catch-all rescued SSHKit::Runner::MultipleExecuteError, which doesn't exist in sshkit 1.25 — a host whose checks failed wholesale became a NameError instead of a recorded SSH failure. The new test was the first thing to trip it.

Closes #98

Test plan

• All seven outcomes covered in test/cli/doctor_test.rb (two new fixtures: sleep+socket, socket-only)
• mount_destinations command shape in test/commands/proxy_test.rb
• Pre-existing doctor tests green (the shared version stub now defaults mounts to empty)
• bundle exec rubocop --parallel clean; full unit suite green
• CI

Deviations & judgment calls

• Severity is graded by consequence: a missing mount is only a FAIL when some role actually has sleep: configured — docker_socket alone is a legal one-key convenience, and a missing mount then breaks nothing yet, so it warns as drift instead. The issue didn't specify; erring toward "FAIL means something is broken right now".
• The stray-socket detection is a heuristic (docker.sock$ on mount destinations) — the gem always mounts the socket at its host path, so this catches every gem-made mount; an operator-mounted socket via run.options with an exotic name would not warn. Deliberate: better to under-warn than false-alarm on custom mounts.
• The sshkit constant fix is bundled rather than split out — it's two lines, the new check is what exposed it, and shipping the check without it would leave the doctor able to crash on the exact hosts it should be diagnosing.
• stub_proxy_version now also stubs mounts to empty — every running-proxy doctor test hits the new inspection, and per-test boilerplate in eight places was worse than one documented default in the shared helper.
• Built in a worktree from latest dash per request (the main mirror is never a valid root — "latest main" for this fork means dash).