Both found the only way they could be found: by running the documented
procedure on a machine that was not the one it was written on.

**tools/rig-install.sh was committed as mode 100644.** It is the first command
in SETUP.md's fast path. It worked for its whole life on the authoring laptop
because the author had chmod'd it there and never committed that — a local
chmod fixes your tree, not the repo, and the index is the only mode that
travels. So `tools/rig-install.sh` on a fresh clone died with "permission
denied", on the one machine the script exists to serve. Five other tracked
shell scripts had the same mode (gpu-mode.sh, init_midi.sh, viz/launch.sh and
two under armada/); all six are now +x in the index.

Fixing the six without a guard would just wait for the seventh, so
tools/tests/test_scripts_are_executable.py reads modes out of `git ls-files -s`
— the index, not the working tree — and fails on any tracked *.sh at 100644.
It also pins the five named entrypoints explicitly so a rename cannot quietly
drop one, and it guards itself: an empty file listing must not read as
success. Mutation-verified in both directions (set gpu-mode.sh back to 644 →
1 failed naming the file and printing the git update-index fix; restored →
3 passed).

**The doctor's fix text for missing units pointed at rig_units.py.** On a
fresh box that is wrong in a way that wastes real time: rig_units.py only
enables and starts units that are ALREADY symlinked into
~/.config/systemd/user/, so `--ensure --apply` returns fifteen consecutive
"Unit file does not exist" lines and reads like a broken reconciler. It isn't
— rig-install.sh is what creates the symlinks. The check now looks at whether
the units are merely not-enabled or genuinely not-found, and points at the
installer in the second case.

That distinction was already in the data (rig_units.py --status prints
"not-found" in the enabled column, and the doctor already parsed that column
into rows) — nobody had read the two facts together, because on a box where
the symlinks have existed for months the not-found branch never fires.

901 passed before, 309 in tools/tests after adding the new file.