v3.15.0

## doctor: four-state audit, post-mortem, live probe

`doctor` is reworked from a flat config prediction into a genuine audit, plus the modes to diagnose real runs.

### Added
- **Four-state audit** — every source is grouped into **WORKING** (verified this run/last run or keyless-always-on), **TURNED ON - UNVERIFIED** (configured/opted-in, no run evidence), **NOT WORKING** (configured but failing, or the last run errored), or **COULD BE ON** (available, not yet configured). One labeled line per source — nothing is buried in a cluster anymore.
- **`doctor --postmortem`** — reads the last run's `last-report.json` and reports what actually broke per source (Failed / Partial / Succeeded / Skipped, with details and fix hints).
- **`doctor --probe`** — a bounded live test that verifies WORKING instead of guessing; also auto-fires on a plain `doctor` when there's no fresh run. Per-source deadline (`LAST30DAYS_DOCTOR_PROBE_TIMEOUT`, default 10s) so a slow source can't hang it. Scoped to free HTTP + keyless CLI sources; credit-gated sources are never probed and stay UNVERIFIED.
- **CLI health** — sources needing a downloaded binary carry a `[CLI: name ✓]` marker and a dedicated CLI-health block. **techmeme, arXiv, and trustpilot** are now audited (they run in research but were previously invisible on the health surface).
- **Backup + comment sub-lanes** — Reddit SC backfill, YouTube SC transcript/search backstop (with a yt-dlp-rate-limit note), X cookie-vs-`XAI_API_KEY` dual path, and youtube/tiktok/instagram comment lanes render as indented sub-lines.
- `doctor --json` gains `audit_state`, `cli`, `backups`, `comments`, `run_outcome`, and a top-level `mode` — all additive.

### Fixed
- Threads no longer reports Ready when it won't run: SC-gated opt-in sources honor `INCLUDE_SOURCES`, so Threads shows COULD BE ON until opted in. TikTok/Instagram stay on-by-default.

**Full PR:** #826