netclaw update: run doctor (read-only) after successful install and surface fixable issues

[Aaronontheweb]

Context

netclaw update currently prints Updated to vX.Y.Z. and exits. When a schema change removes config properties (e.g. Tools.ShellTimeoutSeconds / Tools.MaxToolTimeoutSeconds in 0.24.3-beta.1), existing operator configs silently fail the next doctor run. Operators only discover this if they run doctor themselves — there's no signal at the point of upgrade.

Proposed change

After a successful binary install (not on --check), run the schema doctor check and any other cheap, read-only doctor checks against the operator's config. If any checks fail or warn, emit a compact summary and the fix hint before exiting:

Updated to v0.24.3-beta.1.

[!] Config Schema: Tools.ShellTimeoutSeconds is no longer valid in this version.
    Run `netclaw doctor --fix` to auto-repair, or `netclaw doctor` for full details.

If all checks pass, emit nothing extra (or a one-liner at --verbose).

Design constraints

• Read-only — does not apply fixes; does not write to netclaw.json. Consent for config mutation stays with the operator (netclaw doctor --fix).
• Non-blocking — doctor failures do not change the update exit code. A broken config is not a broken install.
• Suppressible via --no-doctor for scripted/CI update flows.
• Scoped to cheap checks only (schema validation, config parse). Do not run network-dependent checks (MCP connectivity, Slack auth) in the update path.

Implementation sketch

• UpdateCommand.PerformUpdateAsync (src/Netclaw.Cli/Update/UpdateCommand.cs): after the final Console.WriteLine($"Updated to v{result.LatestVersion}."), call a new RunPostUpdateConfigCheck(paths) helper.
• RunPostUpdateConfigCheck: instantiate and run ConfigSchemaDoctorCheck (and perhaps ExposureModeDoctorCheck). Collect non-pass results, print the compact summary block only if there are any. Guard on --no-doctor.

Why not auto-fix?

doctor --fix modifies operator-owned config. Bundling that into netclaw update without explicit consent violates the "no silent fallbacks" principle — the operator should see what's wrong and decide to fix it, not have their config silently rewritten as a side effect of an upgrade.

Acceptance criteria

• netclaw update (successful install, fixable config issue) → compact warning + fix hint printed before exit
• netclaw update (successful install, clean config) → no extra output
• netclaw update --check → no doctor check runs (check-only is read-only; don't add noise)
• netclaw update --no-doctor → doctor check suppressed entirely
• Doctor failures do not change the update exit code
• Unit test: mock paths + stale config → post-update check emits warning text