Proposal: aws doctor, a built-in read-only troubleshooter for the AWS CLI

When the AWS CLI fails, the error rarely tells you why. `SignatureDoesNotMatch`, `ExpiredToken`, `Unable to locate credentials`, `Could not connect to the endpoint URL`, `CERTIFICATE_VERIFY_FAILED`, "you must specify a region". The cause is almost always local: an expired login, a clock that drifted, a typo in a config file, the wrong region, or a corporate proxy or CA. The steps to diagnose these are already documented, but today a user has to know the sequence, run each command by hand, and interpret the output. Search this repo's issues for those error strings and the same handful of causes shows up again and again, over years, not as a one time spike.

I would like to add `aws doctor`: a read-only command that runs those checks for you and prints a clear report of what is healthy, what is broken, and the exact command to fix each problem. It reuses the CLI's own `botocore` session, so it reports the state the CLI actually resolved instead of guessing, and it never changes anything on your machine or in your account.

The first release is a focused, deterministic checklist that covers the causes behind the most common CLI failures. Keeping it deterministic and read only is exactly what makes the results trustworthy, and it gives us a solid foundation to build on. The checks are:

* Environment: CLI version, installation and PATH (including stale or shadowing binaries), Python runtime.
* Configuration: config and credentials files parse and the profile exists, credentials file permissions, region resolution and which source won, alias file.
* Credentials: present, expired, and which provider supplied them, then identity via a single `sts:GetCallerIdentity` call.
* Connectivity: system clock skew against the server time, outbound HTTPS on 443, and TLS with CA bundle validation.

It carries a small set of flags: `--check` to run a subset by name or category, `--profile`, `--output json`, `--output-file` for CI artifacts, `--verbose`, and `--strict` to exit non zero when a check fails. By default it always exits `0`, so it is safe to run in any broken state.

Discoverability is part of the proposal, not an afterthought. For the specific errors it understands, the CLI's own error output gains one advisory line pointing at `aws doctor`. That line never changes the exit code and appears only on human facing error output, so scripts and machine readable formats stay clean.

A few boundaries worth stating up front, because they are what make the tool trustworthy:

* It is not a config editor. It reads and reports. It does not rewrite your files.
* It is not a fixer at launch. It tells you the command to run. It does not run it for you.
* It is not a service error explainer. It diagnoses your local setup and connectivity, not why a specific API call returned a business error.
* It is not AI. It is deterministic, with no model and no inference.
* It is not a security scanner. It checks whether the CLI can function.
* It does not phone home. The only network calls it makes are to your AWS endpoints (`sts:GetCallerIdentity` and lightweight reachability probes). No telemetry, no third party calls.

Naturally, there is more we can do from here: applying fixes, explaining an arbitrary error code, diagnosing the last failed command, simulating permissions, and producing a shareable report. Each carries its own safety, privacy, or maintenance considerations and will follow with its own design once the core is proven.

I have a working implementation with unit and functional tests and would like to open a PR against `v2`. Raising it here first, per CONTRIBUTING, to align on the approach before the code review.

Start with CONTRIBUTING and the v2 implementation, then inspect the existing unit and functional tests mentioned in the proposal. Confirm the agreed scope for the read-only checks, flags, exit behavior, and human-facing advisory output; done means the design is aligned and a tested PR is ready.

Written by the indexing model from the issue text.