feat(doctor): X6 — safe doctor --fix (non-destructive reconcile) (spec 13) (#49)

Wire `--fix` to the only strictly non-destructive remediation: the self-healing
ledger reconcile (prune ref rows for projects no longer live), via
Manager.Reconcile. It NEVER drops a volume/DB/container — those stay explicit-
confirmation jobs (`shared gc`, `workspace destroy`). Best-effort: a down daemon
or non-workspace dir is reported, not fatal.

With the trust/dns/shared probes (PRs #33/#35/#48) this completes X6: the full
doctor matrix + a safe --fix.

Verified: `doctor --fix` outside a workspace prints "reconcile skipped" and
exits 0.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: gustavobertoi

internal/cli/doctor.go

@@ -40,7 +40,7 @@ func newDoctorCmd(g *GlobalOpts) *cobra.Command {
 			}
 			renderChecks(cmd, checks)
 			if fix {
-				fmt.Fprintln(cmd.OutOrStdout(), "\n(--fix has no automatic remediations wired yet; planned with M6 doctor)")
+				doctorFix(cmd)
 			}
 			for _, c := range checks {
 				if c.Status == docker.StatusFail {
@@ -55,6 +55,28 @@ func newDoctorCmd(g *GlobalOpts) *cobra.Command {
 	return cmd
 }
 
+// doctorFix applies the STRICTLY non-destructive remediations (spec 13): the
+// self-healing ledger reconcile (prune ref rows for projects no longer live). It
+// never drops a volume/DB/container — those are explicit-confirmation jobs
+// (`shared gc`, `workspace destroy`). Best-effort: a down daemon or no workspace
+// is reported, not fatal.
+func doctorFix(cmd *cobra.Command) {
+	w := cmd.OutOrStdout()
+	fmt.Fprintln(w, "\n--fix: applying safe remediations…")
+	mgr, closeFn, err := buildManager(cmd)
+	if err != nil {
+		fmt.Fprintf(w, "  reconcile skipped: %v\n", err)
+		return
+	}
+	defer closeFn()
+	pruned, err := mgr.Reconcile(cmd.Context())
+	if err != nil {
+		fmt.Fprintf(w, "  reconcile skipped: %v\n", err)
+		return
+	}
+	fmt.Fprintf(w, "  reconciled the ledger: pruned %d stale ref row(s)\n", len(pruned))
+}
+
 // rebuildLedger reconstructs the shared_service + ref ledger from on-disk config
 // intersected with live container labels (spec 09 §crash-recovery).
 func rebuildLedger(cmd *cobra.Command, g *GlobalOpts) error {