feat(doctor): integrate aggregate workstation polish validation

[Copilot]

doctor.sh had no visibility into the Mac-on-Linux polish layer — missing keyboard policy issues and absent mac-polish helpers were silent. This adds consumption of bin/check-workstation-polish.sh with warning-only (never hard-failure) signal reporting.

Changes

• profiles/linux-dev/workstation-v0/doctor.sh
  • Added check_workstation_polish() — resolves and runs bin/check-workstation-polish.sh, parses its key=value output, records three doctor results:
    • mac-polish-helper — ok if check-mac-polish.sh is present, warn if missing
    • keyboard-policy-helper — ok if check-keyboard-policy.sh is present, warn if missing
    • keyboard-policy — ok if policy_ok=yes, warn (value: invalid) otherwise
  • Missing or failing aggregate helper → warn, never error; fail flag is never set by this path
  • Called from main() after check_lampstand_unit, before the GNOME block
  • Uses grep -Fqx for presence/missing checks, consistent with existing codebase style

Shape preserved

Existing JSON contract unchanged:

{
  "kind": "sourceos.doctor",
  "profile": "linux-dev/workstation-v0",
  "ok": false,
  "summary": { "ok": 11, "warn": 7, "error": 25, "info": 2 },
  "results": [
    { "level": "ok",   "name": "mac-polish-helper",    "message": "present" },
    { "level": "ok",   "name": "keyboard-policy-helper","message": "present" },
    { "level": "warn", "name": "keyboard-policy",       "message": "invalid" }
  ]
}

[mdheller]

Replay review:

This PR remains conceptually relevant, but it is non-mergeable against current main and should not be merged as stale history.

Preserve the useful idea: doctor.sh should consume aggregate workstation polish output as warning-only signals so missing Mac polish / keyboard-policy helpers are visible without hard-failing the workstation profile.

Recommended action:

• replay this behavior into a fresh workstation acceptance cleanup branch together with workstation-v0: add status JSON validation evidence for aggregate polish warnings #125, workstation-v0: extend aggregate polish helper with dock and shortcut signals #146, feat(workstation): add mac-defaults validation helper and CI workflow #148, docs: add Mac-on-Linux acceptance matrix for workstation-v0 #129, and the runbook/doc updates;
• keep the JSON contract stable;
• ensure the replay uses whatever aggregate helper shape exists on current main.

After the replay PR is opened, this PR can be closed as superseded.

[mdheller]

@copilot Fix conflicts

[Copilot]

@copilot Fix conflicts

Conflicts resolved in 0c4c1c9. Both branches had independently added check_workstation_polish() with slightly different implementations; the merge keeps the origin/main version (which uses grep -Fqx for presence checks, consistent with the existing codebase style) while preserving the call from main(). Syntax check and JSON schema validation both pass.