OCA doctor: surface Advance canaries + add environment-specific checks (S1)

[JRedeker]

Summary

oca doctor should be the user-facing health surface that combines:

1. Advance-owned signals read from Advance (Temporal worker heartbeat, search attrs, plugin load status — all already exposed via adv_temporal_diagnose)
2. OCA-environment-specific checks that plugins can't do (MCP server reachability via Vision, plugin install validity, opencode.json rendering integrity, stack.toml schema validity)

Why

Under the cleaner ownership boundary, Advance owns the canary logic (it's plugin-doable). OCA owns the surfacing and adds environment-layer checks that are outside any plugin's scope.

Acceptance Criteria

• oca doctor --scope adv-runtime reads from adv_temporal_diagnose (does not duplicate detection)
• oca doctor --scope environment adds OCA-specific checks: MCP server reachability, plugin install validity, opencode.json rendering integrity
• oca doctor --scope all runs both
• Non-zero exit on critical failures
• JSON output mode for scripting
• Each canary has a clear remediation hint

Boundary

• Advance owns canary detection logic (already in adv_temporal_diagnose)
• OCA owns the user-facing health surface and environment-layer checks

Companion ADV issue

Advance may want to expand adv_temporal_diagnose coverage if gaps exist. Tracked separately if needed.

Proposal

docs/proposals/2026-05-03-oca-runtime-doctor-canaries.md
docs/proposals/2026-05-08-cross-repo-boundary-audit.md § Litmus Test

WSJF Estimate

Value: 7 | TC: 5 | RROE: 6 | Effort: 3 | WSJF: 6.0

[JRedeker]

Scope expansion (2026-05-11): add worker-singleton canary to surface Sharper-Flow/Advance#117 in the doctor + tmux status bar. Specifically:

• New check in oca doctor --scope adv-runtime: walk /proc for worker.js processes; count per project (via cwd → git rev-parse root); compare to expected (1 per project per rq-workerSingleton01); flag mismatch.
• Surface in tmux status bar via oca adv-status (see Replace adv_status.sh with oca adv-status Go subcommand (O2) #24): show worker-count warning when leaked workers detected.
• Composes naturally with the existing OCA doctor: surface Advance canaries + add environment-specific checks (S1) #18 acceptance criteria (read Advance signals + add environment-specific checks).

Rationale: ~2.2 GB RAM waste in operator's current environment caused by the worker leak. OCA's job is surfacing it; Advance owns the fix.