Fold doctor into status, and stop id taking the lock

`status` asked a running agent and failed without one; `doctor` checked
the host and ignored the agent. Between them they answered one question
in two halves. They are now one command: device, agent, networks, host
capability, local addresses, all graded and aligned the same way.

`id` was worse than either. It spawned a whole agent to print three
facts, which took the directory lock and so failed with "owned by
another running agent instance" exactly when the answer was most wanted.
The lock exists to keep one writer over the mandatory state; reading who
this device is needs no such thing.

So both commands now prefer the running agent, which is live and
authoritative, and fall back to the state store, which takes no lock.
StateStore gains device_identity(), which reads and never writes:
load_or_create had the side effect of deciding an identity as a
consequence of asking about one.

Presentation moved out of the library. StatusReport::render is gone and
the CLI renders the structured data, so there is one renderer rather than
two that would drift. Health gains an Info level for rows that are facts
rather than checks — an endpoint id is neither good nor bad, and a column
of green next to plain data teaches the eye to ignore the column. A
report with no checks in it now ends without a summary instead of
claiming that everything checked out.

PathAddr and TransportKind grew Display impls; both were reaching the
user through {:?}, which is how "Direct via Ip(88.198.17.44:49792)" got
printed. The transport grading compares without regard to case, because
the agent answering can be a different build from the client asking and
this field's spelling has now changed once.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/local_control.rs

@@ -158,11 +158,16 @@ async fn a_client_sees_the_agent_and_its_overlay() {
     assert_eq!(overlay.mtu, 1280);
     assert_eq!(overlay.peers.len(), 1);
 
-    // The rendering a user actually sees mentions the important parts.
-    let rendered = report.render();
-    assert!(rendered.contains(&agent.endpoint_id().to_string()));
-    assert!(rendered.contains("1/1 tunnel(s) up"), "{rendered}");
-    assert!(rendered.contains(&overlay.address));
+    // The report carries what a reader needs, in structured form: how it is
+    // laid out is the CLI's business and is tested there.
+    assert_eq!(report.endpoint_id, agent.endpoint_id().to_string());
+    assert_eq!(
+        overlay.peers.iter().filter(|peer| peer.is_up()).count(),
+        1,
+        "the tunnel is up: {:?}",
+        overlay.peers
+    );
+    assert!(!overlay.address.is_empty());
 
     control.shutdown().await;
     assert!(!socket_path.exists(), "the socket is removed on shutdown");
@@ -226,3 +231,46 @@ fn the_socket_path_is_derived_and_short_enough() {
         control_socket_path(&std::path::PathBuf::from("/somewhere/else"))
     );
 }
+
+/// Asking who this device is must not need the directory lock.
+///
+/// The lock belongs to the one agent allowed to *write* the state. `id` only
+/// reads, so making it take the lock would mean the question could never be
+/// answered while an agent was running — which is exactly when you want to
+/// ask it.
+#[cfg(feature = "cli")]
+#[tokio::test]
+async fn identity_can_be_read_while_an_agent_holds_the_directory() {
+    let dir = TempDir::new().unwrap();
+    let discovery = SharedMemoryDiscovery::new();
+
+    // Hold the directory the way a running agent does.
+    let agent = Agent::spawn(config_with(dir.path(), &discovery))
+        .await
+        .unwrap();
+    let expected = agent.endpoint_id().to_string();
+
+    let output = tokio::process::Command::new(env!("CARGO_BIN_EXE_tsunagi"))
+        .arg("id")
+        // The same layout `StoragePaths::under` gives the agent above.
+        .arg("--state-dir")
+        .arg(dir.path().join("state"))
+        .arg("--cache-dir")
+        .arg(dir.path().join("cache"))
+        .output()
+        .await
+        .unwrap();
+
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    assert!(
+        output.status.success(),
+        "`id` failed while an agent was running:\n{stderr}"
+    );
+    assert!(
+        stdout.contains(&expected),
+        "expected {expected} in:\n{stdout}"
+    );
+
+    agent.shutdown().await;
+}