shape-doctor.py: for a pin or a contracts/ this user cannot read, the legs, manifest kinds and shape currency rows disagree with validate-pins.py's named refusal, and manifest kinds names a git checkout HEAD -- that discards work #847

The doctor's rows should agree with validate-pins.py about a pin, or a contracts/ folder, that this user cannot read. #712 (PR #827) makes the gate refuse those by name: REFUSED yaml-unreadable: contracts/spec-pin.yaml: cannot be read (Permission denied), with a remedy for the permission. Three of the doctor's rows still say something else, and one of them names the wrong way out.

Where it comes from: lane 3's RV827 review of #827, S3 (#827 issuecomment-6236474296). It was measured on #827's head 9ecf7bf3 against main 24a977c0, on a real scaffold, with Python 3.12.3.

• RV827 asked for a follow-up for the doctor's rows, outside validate-pins.py and repo_shape.py: a pin, the manifest or a shape copy the gate cannot reach or read is refused by name, relative to the root, once and with its cause's advice, and every name and path it prints is spelled (#712) #827's files.
• validate-pins.py and repo_shape.py: a pin, the manifest or a shape copy the gate cannot reach or read is refused by name, relative to the root, once and with its cause's advice, and every name and path it prints is spelled (#712) #827's PR body records it under "What it cannot tell".
• Lane 4 files it here because validate-pins.py: an unsearchable contracts/ still ends in a PermissionError, an unreadable pin is named by its absolute path twice, and a workflow name or a pin entry's control character reaches stderr raw #712 is lane 4's. The doctor's tracker, Tracking: shape-doctor.py, reporting a repository's compliance #460, is closed.

Not a regression: the doctor's lines are byte for byte main's.

What the doctor says (measured):

• It agrees in one place: its pins row now quotes the gate's named refusal, where main quoted a crash.
• The legs row (shape-doctor.py:5735 on 9ecf7bf3, through pin_commit at :4945):
  • it says contracts/spec-pin.yaml carries no 40-hex commit;
  • its verdict is DRIFTED, both for a pin at mode 000 and for contracts/ at 000;
  • the gate says the pin cannot be read.
• With contracts/ at 000: manifest kinds and shape currency both say could not be run: [Errno 13] Permission denied: '<ROOT>/contracts'.
• For a pin at 000: manifest kinds gives the NEXT step git checkout HEAD -- contracts/spec-pin.yaml, which "discards the uncommitted change that broke it". That is the wrong remedy for a permission fault.

Expected:

• For a pin, or a contracts/ folder, that this user cannot read or search, each of these rows names the fault the gate names: the file or folder, that it cannot be read, and why. It is never carries no 40-hex commit, DRIFTED or an [Errno 13] line.
• The NEXT step is the gate's permission remedy, never a git checkout that would discard work.
• One test per row: a pin at 000 and contracts/ at 000, plus a refused stat stand-in so it runs as root and on Windows, as validate-pins.py and repo_shape.py: a pin, the manifest or a shape copy the gate cannot reach or read is refused by name, relative to the root, once and with its cause's advice, and every name and path it prints is spelled (#712) #827's refused_stat rows do.

Lands after: #827 (#712), whose named refusals and words the rows should quote.

Files: scripts/shape-doctor.py (the legs, manifest kinds and shape currency rows, and pin_commit), and a new test file.

Effort: S to M. Platform: all. The mode rows skip on Windows and as root; the refused-stat rows stand in there.

Milestone: v1.1.1, which lane 3, the release owner, may move.