Diagnostics framework: DiagnosticReport, renderer, check registry, log reader, check-skipping roots

Part of the diagnostics epic (#1110).

Build the shared engine that `doctor`, `diagnose`, and per-component ` diagnose` all consume, so no check is implemented twice.

## Scope

- `DiagnosticReport` type — a uniform result carrying: area/name, status (pass/warn/fail), message, operator-actionable hints, and optional detail fields. Mirrors the reason+hints contract already used by `errx`/`internal/doctor`.
- Text + JSON renderer for `DiagnosticReport` (and slices of them). Text reuses the existing styled output (`Bold`/`Red`/`Yellow` etc. in `internal/doctor`); JSON is stable/machine-readable.
- A **check registry**: register named checks (grouped by area) so `doctor` can enumerate and run every check, and `diagnose`/component commands can run a subset.
- A **log reader** that scans the NDJSON CLI log (`/solo-provisioner.log`) from the end and returns the last N error entries as `ErrorDiagnosis` (reason, hints, build, message/stacktrace, timestamp). Powers `diagnose logs --last-error`.
- `doctor` and `diagnose` cobra roots that **opt out of global checks** (same mechanism as `version`), so they work on an uninstalled/broken host.

## Acceptance

- A check can be registered and run, producing a `DiagnosticReport` rendered identically in text and JSON.
- The log reader returns the most recent error(s) from a sample NDJSON log, including reason/hints/build.
- `diagnose`/`doctor` roots run without triggering install/global checks.

## Notes

Reuses `internal/doctor` (already fetches build info into `ErrorDiagnosis.Version`/`.Commit`) and its styled renderer. No new error namespaces.

Start with the existing internal/doctor ErrorDiagnosis contract and styled renderer, then inspect the doctor, diagnose, and component diagnose Cobra roots alongside the version root's global-check opt-out. Use a sample NDJSON CLI log to validate the log reader. Done means registered checks produce matching text/JSON reports, recent errors include reason, hints, and build data, and both roots run without global checks.

Written by the indexing model from the issue text.