workspace doctor: detect repos present in workspace root but not declared in manifest

[codeforester]

Problem

basectl workspace check and workspace doctor verify that repos declared in the workspace manifest are healthy, but the inverse check is missing: repos that exist under workspace.root on disk but are not declared in the manifest are silently ignored. This lets the manifest and the actual workspace drift apart with no signal.

Example scenario: A developer checks out an unrelated repo directly under ~/work/ (the workspace root), or the workspace grows as new projects are created. The workspace manifest falls behind, but workspace doctor reports everything green because it only validates declared repos.

Proposed solution

Add a new workspace doctor finding (new stable ID, e.g. BASE-W0xx) that:

1. Scans all directories under workspace.root that look like Git repos (have a .git directory or are bare repos).
2. Compares against the set of repos declared in the workspace manifest.
3. Reports repos present on disk but not declared — with warn severity (non-blocking by default).

The finding should suggest one of two remediation paths:

• Add the repo to the workspace manifest (if it should be managed).
• Mark it explicitly as unmanaged in the manifest (if it is intentionally outside workspace control).

Acceptance criteria

• New stable doctor finding ID assigned and documented (never reused, in docs/doctor-findings.md or equivalent).
• Finding appears in workspace doctor output (both human-readable and --format json).
• Finding is warn severity by default (does not block workspace check passing).
• The finding body lists each undeclared repo path.
• Test coverage for: workspace with all repos declared (no finding), workspace with one undeclared repo (finding), workspace with two undeclared repos.
• workspace manifest --help or equivalent documentation updated to mention the undeclared-repo scenario.