feat(storage): add bounded thread store doctor

[XingYu-Zhong]

Summary

• Rebuilds the read-only thread-store doctor from feat(storage): add read-only thread store doctor #949 on the current develop branch.
• Provides a bounded diagnostic service and versioned report contract without mutating production store files.

Changes

• Diagnoses thread metadata, messages/events JSONL, SQLite indexes, and attachment metadata/content.
• Enforces hard caps for directory entries, threads, attachments, records, per-artifact bytes, and total bytes; JSONL scanning is single-pass and bounded.
• Tracks and rechecks every inspected artifact plus relevant directories before returning, including SQLite/WAL stability.
• Queries SQLite from a private bounded buffer, runs integrity checks, validates the complete HybridThreadStore schema/index contract, and executes rollback-only runtime write probes against that isolated copy.
• Rejects schema changes that alter real write semantics, including unexpected persistent tables and inbound foreign keys, incorrect defaults, CHECK/foreign-key constraints, triggers, generated/hidden columns, unique/partial/expression/non-BINARY indexes, case-folded IDs, and same-timestamp usage conflicts.
• Preserves compatibility with healthy historical ALTER TABLE column ordering, and uses a constant-size UUID probe plus a single primary-key query instead of candidate-by-candidate table scans.
• Fails closed on non-empty/changing WAL state and never opens the production database, so diagnostics do not create or modify store sidecars.
• Verifies attachment size and SHA-256 content integrity while caching only bounded scope sets, and mirrors runtime threadId OR workspace authorization semantics.
• Uses the same canonical-metadata/legacy-thread fallback precedence as the runtime and reports the selected metadata source.
• Tracks scan completeness independently from aggregate artifact severity, so a mismatch or invalid attachment cannot hide a concurrent change, limit hit, or indeterminate scope; non-file and unreadable path identities are also rechecked.
• Reports invalid/active indexes at report level even with no thread directories, and flags rebuildable index-only rows without inventing thread diagnostics.
• Ignores normal activity in unrelated runtime, background-shell, legacy, and unreferenced-attachment paths.

Tests

• Targeted diagnostics/race tests (39 passed).
• Full Kun suite (2179 passed, 1 skipped).
• Kun and root typecheck, full GUI/Kun build, full ESLint, and git diff --check.

Original contribution and diagnostic direction: @luoye520ww in #949.

Replaces #949.