gloop doctor: preflight repo-settings and environment check

Problem

Every one of the 8 landed PRs in the fishtank run printed:

gloop auto-merge is not allowed for this repository; enable it with `gh api -X PATCH repos/... -F allow_auto_merge=true`

The direct-merge fallback (#37) worked, so nothing broke — but the actionable warning scrolled by 8 times in mid-run output where an operator watching GitHub (not stdout) never sees it, and repo misconfiguration was only discoverable after starting a run.

Proposal

A gloop doctor subcommand (or a preflight block on first run) that checks the repo/environment against gloop's expectations and reports actionable findings once, up front:

• allow_auto_merge enabled (or explicit note that direct-merge fallback will be used)
• required labels present (gloop:*, priority:*) — today they're created lazily
• gh authed with sufficient scopes; clean working tree; default-branch protection compatible with squash-merge
• runtime deps the verify loop needs (node version; Java for Firebase-emulator repos is repo-specific, so keep this list config-driven via .gloop.json)

Exit non-zero on hard blockers, warn on soft ones.

Acceptance

• gloop doctor runs read-only, prints pass/warn/fail per check with the fix command.
• First gloop run surfaces the same summary once (not per-land).

Start by reviewing the proposed gloop doctor entry point and the .gloop.json configuration described in the issue. Define the read-only repository and environment checks, distinguishing hard blockers from soft warnings. Done means the command reports pass/warn/fail results with fix commands, exits non-zero for blockers, and the first gloop run shows the summary only once.