Detect stale systemd service templates in doctor

[wnlen]

Summary

• Add a read-only doctor check for stale systemd/systemd-user unit templates.
• Warn when an installed unit still uses Type=forking, PIDFile=, or clashctl start-direct.
• Tell users the explicit refresh and restart commands instead of automatically rewriting unit files.
• Add a regression check for stale unit detection and warning text.

Validation

• bash -n install.sh uninstall.sh scripts/core/*.sh scripts/init/*.sh scripts/dev/*.sh
• for f in scripts/dev/*.sh; do case "$f" in *check-runtime-config-normalization.sh) echo "skip $f (needs temporary yq download)";; *) bash "$f";; esac; done

Risk

Read-only diagnostic change. It does not write unit files, restart services, or change update behavior.