feat: runpool doctor, and queue time in stats

[aicayzer]

Two reporting commands, in one branch because they share bin/runpool's dispatch and help, the README command table and skills/runpool/SKILL.md. Neither changes anything on a machine.

Closes #33, closes #34.

runpool doctor (#33)

One read-only command for "why is nothing picking this up". Lives beside _rp_status in lib/scheduler.sh, because it reports and changes nothing and that is the file's concern.

The check that earns it: nothing today looks at the tick and clean agents after schedule install writes them. If the tick agent is not loaded, no pool autoscales, every job waits for a manual runpool up, and status reports every pool as perfectly healthy — because locally they are. The rest are each visible somewhere and never together: gh authentication (_rp_require covers presence only), registrations, per-pool launch agents, org pools with an empty watch list, disk headroom against RUNPOOL_BASE rather than /, the config's permissions, and the organisation's runner-group setting.

Every failure names its remedy. Exit is non-zero when something is actually wrong, zero otherwise; warnings do not fail it.

Two things are shared rather than restated.

• _rp_gh_state now holds the one judgement about a pool's registration. status renders it as its note and doctor as a check with a fix, so a second copy cannot drift from the first or from how GitHub actually behaves. status's output is byte-identical before and after.
• _rp_org_allows_public moves the runner-group read into lib/common.sh, returning true, false or unknown — unknown deliberately not folded into false, since reading it needs admin:org. register consults it once at create; the setting can be switched on the day after. Reported and never re-derived: no enumeration of an organisation's public repositories, per SECURITY.md.

Strictly read-only, and a boundary rather than a preference: a diagnostic that repairs is one nobody can run safely while confused, and every repair already exists as its own command. The config's mode is checked and the pools file's is not, because install.sh omits that chmod on purpose.

runpool stats --queue (#34)

Median and p90 of the wait before a runner picked each job up, per workflow / job, in the shape the duration table already uses.

• Behind a flag, not in default stats. lib/stats.sh reads only local files; the join makes one gh api call per unique run. A network fan-out behind a casually-run command is the failure status --json --local exists to prevent.
• contrib/telemetry-join.sh is invoked, not absorbed. It carries two traps that took working out — the run-id fan-out with its nearest-start tie-break, and created_at being run-level rather than job-level — and two copies is two places to get them wrong. The telemetry path is passed as $1, so the script does not fall back to re-entering whatever runpool is on PATH.
• The qualifier ships with the number, every time. queue_s conflates a cold pool waking with an unfinished dependency with a genuine shortage of runners, and only the last is fixed by capacity. This file exists in its present form because a canned analysis already shipped a confidently wrong answer on exactly that.

Verification

• /bin/bash -n under /bin/bash 3.2.57, and shellcheck --severity=warning via the Docker image in CONTRIBUTING.md. Both clean.
• doctor watched failing, not only passing. Against a scratch RUNPOOL_BASE, RUNPOOL_LOG_DIR and RUNPOOL_POOLS_FILE, with hand-written pool configs and no registration, resize or removal anywhere: paused, no pools, an incomplete pool config, missing launch agent plists, an org pool with no watch list, a pool GitHub has no runners for, an unloaded tick agent, gh absent, gh present but unauthenticated, every API call failing, a config at mode 644, and — on two small attached volumes — the sub-5GB and sub-20GB disk branches. Both exit codes confirmed. The offline classification was exercised with a canned gh returning registered-but-none-online.
• --queue cross-checked against contrib/telemetry-join.sh on the same 400-record subset: 198 joined rows, 15 job types, and every median and p90 agrees exactly with the quantiles computed independently from the raw TSV. Two runs produced identical tables.
• status and default stats diffed against main on the same fixtures: identical apart from the intended pointer to --queue.