fix: align doctor checks with skill lock paths

[kkkhs]

Description

Fixes #330.

rolecraft doctor now derives skill directory checks from each lockfile entry's recorded agents, so agent-specific installs such as ~/.claude/skills are not reported missing. It also compares shared skill directory names against normalized lock slugs so scoped slugs are not reported as orphaned.

Validation run:

• node --test src/api/doctor.test.js
• node --test src/commands/doctor.test.js
• PATH=/tmp/rolecraft-gitwrap:$PATH npm test (local Git is 2.20.1, so the wrapper only translates git init -b used by release-prep tests)
• node --check src/api/doctor.js
• node --check src/api/doctor.test.js
• git diff --check
• GitHub CI: Tests on Node 24/26 for ubuntu/macos and CodeQL passed; Node 24 jobs include npm run lint.

Local npm run lint reaches Biome, but this machine's glibc is 2.28 and the installed Biome binary requires GLIBC_2.29/2.30.

Type of change

• Bug fix
• New feature
• Documentation update
• Refactor

Checklist

• Tests pass locally (npm test)
• Lint passes (npm run lint)
• No new dependencies added
• Docs updated if needed

Related issue

Fixes #330

[github-actions]

🎉 Thanks for opening your first pull request in RoleCraft!

A maintainer will review it soon — it helps if npm run lint and npm test pass locally.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[sametcelikbicak]

Nice catch on the orphan check — the name.replace(/-/g, '/') heuristic was genuinely broken, and keying the search dirs off the lock entry's recorded agents is the right shape. Two things before merge.

1. getDirForAgent ignores the cwd argument.

lockEntrySkillDirs receives cwd and uses it for the project entry on the line above, but project-scoped agents resolve through proj() → process.cwd(). The two disagree whenever they differ:

skill really at     /tmp/x/.devin/skills/acme-devin-skill
apiDoctor('/other') → missingDirs: 1

devin, copilot, eve, promptscript and forge all use proj(), so all five are affected. The CLI never shows it — doctorCommand passes process.cwd() — but apiDoctor is exported as doctor from src/index.js, so an API caller passing any other directory gets the same false positive this PR is fixing.

rolecraft/src/api/doctor.js

Line 288 in 27e2021

else addDir(getDirForAgent(agent))

Every other path in apiDoctor resolves through the cwd parameter, so this looks like the one place it was missed.

2. This overlaps #332.

#332 ("project-scoped agents write to the global lockfile") is open and touches the same area. Worth deciding together whether they land as one change — the two share a root cause, and splitting them means whoever reviews second inherits a half-migrated function.

Verified on this branch: the #330 fixture reproduces clean — orphaned: 0, missingDirs: 0, hashMismatches: 0 — with a scoped slug (acme/my-skill → acme-my-skill) and a non-markdown file in the tree. npm run lint passes, 1395/1395 tests pass.