[zongqichen]

Why

Doctor reported ready or authenticated for saved expired tokens because cf target can succeed without contacting Cloud Foundry. Its output now describes local configuration and states that authentication was not verified.

What changed

• Correct both complete-target and missing-org/space messages.
• Add CLI regressions for text and JSON output and document the local diagnostic scope.

Scope

• Covers doctor output only.
• Retains existing statuses, exit codes, and offline behavior.

Blast Radius

Users and JSON consumers receive more precise messages. Shared import checks and login behavior are unchanged.

Verification

• CLI regressions fail before the fix and pass afterward.
• Official CF CLI tests with expired synthetic tokens confirm the corrected messages, unchanged no-token behavior, and zero API requests.
• make check, make release-check, make security, and make smoke pass.

Closes #56. Supersedes #48.

[zongqichen]

PASS

Independent verification covered fc0f43da8614026dc589861e94ca0b3dd4fbee9e
against base f97a748a4a0a57aa16ea1cc6f03b1c43aa234e31.

• Base and head built with Go 1.27.3.
• The official CF CLI probe reproduced both misleading base messages. Head now
  reports saved local state and says authentication not verified.
• The no-token message, doctor status, doctor exit code, and import exit code
  stayed unchanged for all three fixtures. Base and head made zero API requests.
• The text and JSON regression failed at the test-only commit and passed at
  head for complete-target, missing-organization, and missing-space fixtures.
• The exact diff does not change import, target detection, rendering, exit, or
  network behavior.

No blocking findings.