Add the BYO host doctor diagnostics contribution

Part of #1814

## Problem

`reconcile-systems --check` proves a `[[byo_host]]` block is *well-formed*. It cannot prove the BMC
answers, the HMC credential works, or the declared baseline kernel exists — and by design it never
will, because ADR-0121 made that validator deliberately free of Postgres and S3 access so it can
run as a deploy-time job.

That leaves a gap: between declaring a host and allocating it, an operator has no way to find out
that the endpoint is typo'd. Today the first evidence of a misconfigured host would be a failed
allocation an agent is already waiting on.

## Evidence

- `src/kdive/inventory/cli.py:66` — `validate_systems`: "Parse + schema-validate `systems.toml`
with no DB/S3 access... The deploy-time fail-fast validator (ADR-0121): it touches neither
Postgres nor the object store." Extending it with network probes would break that contract.
- `deploy/helm/kdive/templates/job-validate-systems.yaml:37` — it runs as a Helm job with an
explicit `--path`, confirming its deploy-time role.
- `src/kdive/providers/assembly/diagnostics.py:12` — `diagnostic_provider_contributions()`, the
registration seam.
- `src/kdive/providers/remote_libvirt/diagnostics/reachability.py` — the precedent for a provider
reachability contribution (ADR-0091).
- #1823 factors the adopt preconditions into a shared module; this entry consumes it rather than
re-implementing the checks, which is why it follows adopt instead of preceding it.

## Expected outcome

- A BYO contribution registered through `diagnostic_provider_contributions()` covering: SSH
reachability, OOB endpoint reachability, OOB credential validity, arch match against the
declaration, bootloader flavor, kdump/fadump readiness, and baseline-kernel presence.
- Each check names the **specific** defect and its remedy, not a generic failure — this is #1814
success criterion 5.
- Runs against a declared host **before** any allocation exists, so a newly declared host can be
pre-flighted.
- Secrets never surface in diagnostic output; credential validity is reported as a boolean plus a
source-ref, never an echoed value.

Blocked by #1823

Start with #1823's shared adopt-preconditions module, then read src/kdive/providers/assembly/diagnostics.py and the reachability precedent at src/kdive/providers/remote_libvirt/diagnostics/reachability.py. Register a BYO contribution covering the listed host checks before allocation, with specific remedies and secret-safe credential reporting; verify it runs through the diagnostics contribution seam.

Written by the indexing model from the issue text.