Grade and colour what doctor reports

Findings now carry a level: ok, warn or FAIL. The distinction between the
middle two is the part worth getting right — warn is something the agent
runs without and that the user can fix from the line printed beneath it,
FAIL is something it cannot work around. A diagnostic that grades those
the wrong way round is worse than an ungraded one, so each check states
which it is.

The clearest case is storage: the same failure on the state directory is
FAIL and on the cache directory is warn, because one is mandatory and the
other is disposable. That asymmetry is central to the design and the
report now shows it. The control plane check also became real — it binds
a UDP socket rather than asserting that it could.

Colour is redundant by construction. Every row carries its grade as a
word, so the report reads identically when the escapes are gone: piped to
a file, on a dumb terminal, under NO_COLOR, or to someone who cannot
distinguish the colours. anstream decides whether they survive, which
also gets virtual terminal processing right on Windows; it and anstyle
were already in the tree through clap.

What is reported and how it looks are separated, so the rendering is
tested without a terminal: that a plain render contains no escapes, that
a styled one says the same thing once they are stripped, that columns
line up across sections whose labels differ in length, and that the
summary names the worst thing found.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

README.md

@@ -169,7 +169,12 @@ allocation changes. Everything else, including every byte from the network,
 is handled with it lowered. `+ep` works too; the agent lowers it on the way
 in.
 
-`tsunagi doctor` says which of these applies on the host it runs on.
+`tsunagi doctor` says which of these applies on the host it runs on. It
+grades each finding: **ok** for what works, **warn** for what the agent runs
+without and you can fix from the line it prints, **FAIL** for what it cannot
+work around. The words carry the grade as well as the colour, so the report
+reads the same piped to a file or on a terminal without colour, and it honours
+`NO_COLOR`.
 
 ### It cleans up after itself