doctor: surface skill origin URLs from plugin metadata

[JFK]

Goal

Let users visually confirm /gh-issue-driven:doctor that the reviewer skills they think they're using (claude-c-suite:audit, claude-c-suite:cso, claude-c-suite:qa-lead, claude-c-suite:cto, etc.) are the real plugin-installed versions, not local shadows.

Scope

• commands/doctor.md: for each required reviewer skill, read its plugin/marketplace metadata (origin repo + version) and print one line per skill, e.g.

  claude-c-suite:audit    OK   github.com/JFK/claude-c-suite-plugin@v1.4.0
  claude-c-suite:cso      OK   github.com/JFK/claude-c-suite-plugin@v1.4.0
  

• If a skill resolves to a local override or unknown source, mark it WARN with the actual path.

Acceptance criteria

• Doctor fails loud when a required skill is missing.
• Doctor warns (but does not fail) when a required skill comes from a non-canonical source.
• Output is parseable enough that CI can grep it.

Phase

Phase C — v0.3.0+. Lower urgency than security, but important once external users start running this on their own repos.