fix(doctor): stop warning about tools that exist

[dadgrand]

Summary

• doctor warns about tools that exist. isBuiltinOrMetaTool is a hand-written name list and it had drifted from what actually ships: use_capability, compress and update_goal were all missing from it.
• The built-in review and security-review skills both name use_capability in allowed-tools, so every doctor run on a default install prints two warnings for a tool that is present:

warning: skill "review" allowed-tools references "use_capability" which is not in the current registry
warning: skill "security-review" allowed-tools references "use_capability" which is not in the current registry

• Consult the built-in registry first via tool.LookupBuiltin, which cannot drift, and keep the hand-written list as the fallback it already was. compress and update_goal are registered built-ins and are now covered automatically. use_capability is wired up at boot rather than registered, so it is added to the list explicitly with a comment saying why.

Issues

Verification

• 2 warnings before, 0 after, on an otherwise unchanged config and the same workspace.
• go test ./... passes. gofmt -l . and go vet ./... clean. Go 1.26.2, darwin/arm64.
• New tests in internal/doctor/skill_health_registry_test.go:
  • TestAllowedToolsAcceptsAnyRegisteredBuiltin registers a probe tool and asserts it is not reported missing — this pins the registry path rather than a name list, so the same drift cannot recur.
  • TestAllowedToolsStillWarnsOnAnUnknownName asserts a genuinely unknown name still warns, so the softened check does not silence real typos.

Documentation impact

Documentation-impact: none - diagnostics output only; no CLI, config, provider, permission or tool behavior changes.

Cache impact

Cache-impact: none - internal/doctor output never enters the provider request; no system prompt, memory prefix, tool schema or tool surface is touched.
Cache-guard: not applicable - no cache-sensitive path is modified. go test ./internal/boot/ -run TestGoldenBaselineNoExtensions still passes unchanged.
System-prompt-review: N/A