refactor(cli): port debug.sh to TypeScript

[cv]

Summary

Port scripts/debug.sh (355 lines) to src/lib/debug.ts as part of the #924 shell consolidation.

This is the diagnostic collection script that gathers system info, Docker state, gateway logs, and sandbox status for nemoclaw debug. Currently implemented as a bash script that bin/nemoclaw.js shells out to.

Approach

• Write src/lib/debug.ts using execa (not child_process) for subprocess execution
• Replace bin/nemoclaw.js's spawnSync("bash", ["scripts/debug.sh", ...]) with a direct call to the TS module
• Secret redaction must be preserved (the script filters API keys from output)
• Follow the established pattern: TS source in src/lib/, compiled to dist/lib/ via npm run build:cli
• Co-locate tests in src/lib/debug.test.ts, importing from ../../dist/lib/debug for coverage attribution

Context

• Part of refactor(cli): shell consolidation, TypeScript migration & oclif #924 PR 2 scope (port shell scripts to TS)
• No blocker PRs touch this file — safe to proceed immediately
• See refactor(cli): extract pure functions from onboard.js to typed TypeScript modules #1240 and refactor(cli): migrate preflight.js to TypeScript #1262 for the established migration pattern (thin shim in bin/lib/, TS source in src/lib/)
• Coverage ratchet must pass — add tests, never lower thresholds

Not blocked by

Any of the #924 blocker PRs (#781, #782, #819, #672, #794, #634).