Per-component doctor + diagnose (start with consensus node)

Part of the diagnostics epic (#1110). Depends on the diagnostics framework sub-issue.

Add **component-scoped** diagnostics — both the summary sweep and the granular detail — for each component, backed by the shared check registry (`internal/reality` checker + live read-only kube reads). Global `doctor` reuses these same checks; ` doctor` runs the registry filtered to that component.

## Commands

```
solo-provisioner doctor # scoped summary sweep (✓/⚠/✗ + fixes), faster than global doctor
solo-provisioner diagnose # scoped detail / json / targeted checks

# per component:
consensus node doctor | consensus node diagnose [--namespace] # start here — highest value
block node doctor | block node diagnose
kube cluster doctor | kube cluster diagnose
teleport {node|cluster} doctor | teleport {node|cluster} diagnose
alloy cluster doctor | alloy cluster diagnose
```

- ` doctor` = the component's checks rolled into a pass/fail summary with fixes (read-only).
- ` diagnose` = the same checks with full detail and `-o json` for scripting/targeting.
- Both are just views over the shared registry — implement the checks once, register them under the component's area.

## `consensus node` checks (first deliverable)

Encodes the manual troubleshooting we did by hand:
- ConsensusCapsule phase(s) per node.
- Pod status; detect `ImagePullBackOff`/`ErrImagePull`.
- ghcr image-pull secret present in the namespace **and** attached to the per-node `*-consensus-*-sa` ServiceAccounts.
- Genesis: presence of the `genesis-config` ConfigMap (is `network genesis` still pending?).
- Secret precheck: required gossip/grpc-tls secrets exist for each node.
- Each finding carries an actionable hint (e.g. attach imagePullSecrets to the SA + recreate pod, `consensus network genesis …`).

## Acceptance

- `consensus node doctor --namespace hiero-network-1` prints a scoped ✓/⚠/✗ summary with fixes; `consensus node diagnose` prints full detail + `-o json`. Both read-only.
- Consensus checks are registered so global `doctor` picks them up automatically.
- Other components wrap their existing reality checkers in report-only mode under both verbs.

## Notes

Read cluster state via `internal/kube` (no shelling out). Ship `consensus node` first; the rest follow incrementally.

Start with the diagnostics framework sub-issue, then read the shared check registry in internal/reality and the read-only cluster access in internal/kube. Run the listed consensus node doctor and diagnose commands with --namespace, and trace the existing reality checkers for the other components. Done means consensus checks are registered, scoped summary and detail/JSON views work read-only, and global doctor reuses them.

Written by the indexing model from the issue text.