fix(doctor): failed system units warn, failed user units fail

First production run of the failed-units check flipped the whole set-
readiness verdict on apport-autoreport.service — honest but wrong: the
rig runs entirely in user scope, and system-scope corpses (apport, snapd
chores) rarely gate a set. User scope stays a FAIL.

tools/rig-doctor.py

@@ -622,12 +622,24 @@ def check_failed_units() -> None:
             unit = line.split()[0] if line.split() else ""
             if unit.endswith((".service", ".socket", ".timer", ".path")):
                 bad.append(f"{unit} ({scope})")
-    if bad:
-        add("SERVICES", "failed units", FAIL,
-            f"{len(bad)} unit(s) in failed state: {', '.join(bad)} — if the "
-            f"reason is start-limit-hit, plain restart CANNOT revive them",
-            "systemctl [--user] reset-failed <unit> && "
+    user_bad = [b for b in bad if "(user)" in b]
+    sys_bad = [b for b in bad if "(system)" in b]
+    cure = ("systemctl [--user] reset-failed <unit> && "
             "systemctl [--user] start <unit>")
+    if user_bad:
+        # Everything the rig runs is user-scope, so a user-scope corpse is a
+        # set blocker until proven otherwise.
+        add("SERVICES", "failed units", FAIL,
+            f"{len(user_bad)} user unit(s) in failed state: "
+            f"{', '.join(user_bad)} — if the reason is start-limit-hit, "
+            f"plain restart CANNOT revive them", cure)
+    elif sys_bad:
+        # System-scope failures (apport, snapd chores...) rarely gate a set;
+        # surfaced, not blocking. First production run of this check FAILed
+        # the whole doctor on apport-autoreport, which was honest but wrong.
+        add("SERVICES", "failed units", WARN,
+            f"{len(sys_bad)} system unit(s) in failed state: "
+            f"{', '.join(sys_bad)} — not rig units, but worth an eye", cure)
     else:
         add("SERVICES", "failed units", PASS,
             "no failed units in user or system scope")