Fold doctor into status, and stop id taking the lock

`status` asked a running agent and failed without one; `doctor` checked
the host and ignored the agent. Between them they answered one question
in two halves. They are now one command: device, agent, networks, host
capability, local addresses, all graded and aligned the same way.

`id` was worse than either. It spawned a whole agent to print three
facts, which took the directory lock and so failed with "owned by
another running agent instance" exactly when the answer was most wanted.
The lock exists to keep one writer over the mandatory state; reading who
this device is needs no such thing.

So both commands now prefer the running agent, which is live and
authoritative, and fall back to the state store, which takes no lock.
StateStore gains device_identity(), which reads and never writes:
load_or_create had the side effect of deciding an identity as a
consequence of asking about one.

Presentation moved out of the library. StatusReport::render is gone and
the CLI renders the structured data, so there is one renderer rather than
two that would drift. Health gains an Info level for rows that are facts
rather than checks — an endpoint id is neither good nor bad, and a column
of green next to plain data teaches the eye to ignore the column. A
report with no checks in it now ends without a summary instead of
claiming that everything checked out.

PathAddr and TransportKind grew Display impls; both were reaching the
user through {:?}, which is how "Direct via Ip(88.198.17.44:49792)" got
printed. The transport grading compares without regard to case, because
the agent answering can be a different build from the client asking and
this field's spelling has now changed once.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

README.md

@@ -71,7 +71,7 @@ On the first machine:
 ```bash
 cargo build --release
 ./target/release/tsunagi secret          # prints tsn1...; share it privately
-./target/release/tsunagi doctor          # what this host can and cannot do
+./target/release/tsunagi status          # this device, the agent, and this host
 
 ./target/release/tsunagi up --network lab --secret "$SECRET" --wireguard
 ```
@@ -169,12 +169,17 @@ allocation changes. Everything else, including every byte from the network,
 is handled with it lowered. `+ep` works too; the agent lowers it on the way
 in.
 
-`tsunagi doctor` says which of these applies on the host it runs on. It
-grades each finding: **ok** for what works, **warn** for what the agent runs
-without and you can fix from the line it prints, **FAIL** for what it cannot
-work around. The words carry the grade as well as the colour, so the report
-reads the same piped to a file or on a terminal without colour, and it honours
-`NO_COLOR`.
+`tsunagi status` says which of these applies on the host it runs on, along
+with what the agent is doing. It grades each finding: **ok** for what works,
+**warn** for what the agent runs without and you can fix from the line it
+prints, **FAIL** for what it cannot work around. The words carry the grade as
+well as the colour, so the report reads the same piped to a file or on a
+terminal without colour, and it honours `NO_COLOR`.
+
+`status` and `id` both prefer a running agent, which is live and
+authoritative, and fall back to reading the state store when there is none.
+Reading takes no directory lock, so neither has to wait for the agent it is
+asking about — nor does either need one to be running.
 
 ### It cleans up after itself