fix(cli): doctor resolves @opencodehub/sarif as installed pkg, not monorepo path

[theagenticguy]

Summary

codehub doctor reported a misleading WARN to end users:

```
│ @opencodehub/sarif build │ WARN │ @opencodehub/sarif not built yet │ run `pnpm -r build` │
```

sarifSchemaCheck probed <repoRoot>/packages/sarif/dist, where repoRoot is guessRepoRoot()'s 4-dirs-up monorepo guess. On a customer npm i -g @opencodehub/cli install there is no packages/sarif/ tree — @opencodehub/sarif is a normal prebuilt node_modules dependency — so stat always threw and the check WARNed "not built yet", telling end users to run pnpm -r build. That command is nonsensical for an installed copy.

This was the last workspace-package doctor check still hard-coded to the monorepo layout. The native-binding checks (duckdb, lbug) already resolve the installed package via resolveFromRoot/createRequire; vendored wasms via resolveVendorWasmsDir/import.meta.resolve. This check was missed.

Fix

1. Installed deployment first — resolve @opencodehub/sarif's ESM entry via import.meta.resolve and confirm it exists on disk. (sarif's exports map declares only the import condition, so createRequire().resolve() throws ERR_PACKAGE_PATH_NOT_EXPORTED — same reason resolveVendorWasmsDir uses import.meta.resolve.) A resolvable prebuilt entry → ok.
2. Monorepo source-checkout fallback — keep the packages/sarif/dist probe; this is the only context where the pnpm -r build hint is correct.

Test plan

• New regression test: with a bogus repoRoot (kills the source fallback), the check still reports ok against the real installed package — proving installed-package resolution.
• node --test doctor suite: 17/17 pass (dev + compiled dist)
• Full @opencodehub/cli suite: 263/263 pass
• tsc --noEmit workspace: clean
• biome check on changed files: clean