feat(tools): rig-doctor — does THIS machine have what the rig needs at all

Answers a different question than gig-preflight.py's "is the installed rig
HEALTHY right now": on a fresh box with nothing installed, can it even GET
there, and for each gap, the exact command to fix it. Same spirit as fbk
doctor — a friend who bought PLN's old LCXL2 can run this on their own
laptop and paste the output back, turning "does this work elsewhere" from a
guess into a list. Installs nothing; every check reads (binary --version,
systemctl is-active/is-enabled, aconnect -l, git log, subprocess import
probes) and nothing writes to the machine, the repo, or a service.

The rule that matters most: never hardcode /home/pln or any absolute user
path, and re-derive everything at call time (Path.home(), $XDG_DATA_HOME,
Path(__file__).resolve()) rather than baking a module-level constant from
the machine that wrote the file. That class of bug is real and already in
this repo — start_and_midi.scd hardcodes three sample roots as literal
/home/pln/... strings, so on a box where the user isn't pln, SuperDirt
boots clean with those banks silently gone. This tool is built to be the
thing that catches that, which means it can't commit it itself.

Sample coverage deliberately does not parse .tidal files (one parser,
tools/setlist_samples.py, per test_one_tidal_parser.py) — it shells out to
tools/sample-pack.py --all --json and, with --bundle PATH, verifies against
a carry-on bundle's MANIFEST.json as independent ground truth (without one,
sample-pack can only self-report what THIS box already resolves, since
resolving a bank name requires the folder to already exist on disk — a
fresh box has nothing to walk).

Findings from this run (PLN's own working laptop, the correctness signal —
39 pass, 0 fail, 5 warn across all four invocations: human, --json, --quiet,
--bundle /home/pln/Work/Sound/parvagues-carryon):
  - toolchain fully green: sclang/scsynth 3.14.1, all 6 quarks at their
    known-good commits, ghc 9.4.7/cabal 3.14.1.1/tidal 1.10.0, pulsar
    v4.1.0, ardour9, pipewire+pipewire-jack, all 5 python deps
  - all 281 carry-on bundle banks (15.11 GB) present when checked with
    --bundle; 18/18 synthdefs present
  - real, structural gaps this box legitimately WARNs on: /etc/sudoers.d is
    750 root:root, so presence of perf-audio's sudoers rule can't be
    verified without root (reported honestly as "unknown", not a false
    FAIL); no LCXL plugged in at run time; .env/yt-profile absent (this run
    happens to be from a worktree, which doesn't carry gitignored files —
    a checkout artifact, not a machine gap)

python3 -m pytest -q: 903 passed (unchanged baseline).