fix(doctor): UX improvements for diagnostics and daemon (#687)

* fix(doctor): UX improvements for diagnostics and daemon

- Add Repo Fingerprint check to detect when database belongs to a
  different repository (copied .beads dir or git remote URL change)
- Add interactive fix for repo fingerprint with options: update repo ID,
  reinitialize database, or skip
- Add visible warning when daemon takes >5s to start, recommending
  'bd doctor' for diagnosis
- Detect install method (Homebrew vs script) and show only relevant
  upgrade command
- Improve WARNINGS section:
  - Add icons (⚠ or ✖) next to each item
  - Color numbers by severity (yellow for warnings, red for errors)
  - Render entire error lines in red
  - Sort by severity (errors first)
  - Fix alignment with checkmarks above
- Use heavier fail icon (✖) for better visibility
- Add integration and validation tests for doctor fixes

* fix(lint): address errcheck and gosec warnings

- mol_bond.go: explicitly ignore ephStore.Close() error
- beads.go: add nosec for .gitignore file permissions (0644 is standard)

cmd/bd/doctor/version.go

@@ -34,14 +34,12 @@ func CheckCLIVersion(cliVersion string) DoctorCheck {
 
 	// Compare versions using simple semver-aware comparison
 	if CompareVersions(latestVersion, cliVersion) > 0 {
-		upgradeCmds := `  • Homebrew: brew upgrade bd
-  • Script: curl -fsSL https://raw.githubusercontent.com/steveyegge/beads/main/scripts/install.sh | bash`
-
+		upgradeCmd := getUpgradeCommand()
 		return DoctorCheck{
 			Name:    "CLI Version",
 			Status:  StatusWarning,
 			Message: fmt.Sprintf("%s (latest: %s)", cliVersion, latestVersion),
-			Fix:     fmt.Sprintf("Upgrade to latest version:\n%s", upgradeCmds),
+			Fix:     fmt.Sprintf("Upgrade: %s", upgradeCmd),
 		}
 	}
 
@@ -52,6 +50,36 @@ func CheckCLIVersion(cliVersion string) DoctorCheck {
 	}
 }
 
+// getUpgradeCommand returns the appropriate upgrade command based on how bd was installed.
+// Detects Homebrew on macOS/Linux, and falls back to the install script on all platforms.
+func getUpgradeCommand() string {
+	// Get the executable path
+	execPath, err := os.Executable()
+	if err != nil {
+		return "curl -fsSL https://raw.githubusercontent.com/steveyegge/beads/main/scripts/install.sh | bash"
+	}
+
+	// Resolve symlinks to get the real path
+	realPath, err := filepath.EvalSymlinks(execPath)
+	if err != nil {
+		realPath = execPath
+	}
+
+	// Normalize to lowercase for comparison
+	lowerPath := strings.ToLower(realPath)
+
+	// Check for Homebrew installation (macOS/Linux)
+	// Homebrew paths: /opt/homebrew/Cellar/bd, /usr/local/Cellar/bd, /home/linuxbrew/.linuxbrew/Cellar/bd
+	if strings.Contains(lowerPath, "/cellar/bd/") ||
+		strings.Contains(lowerPath, "/homebrew/") ||
+		strings.Contains(lowerPath, "/linuxbrew/") {
+		return "brew upgrade bd"
+	}
+
+	// Default to install script (works on all platforms including Windows via WSL/Git Bash)
+	return "curl -fsSL https://raw.githubusercontent.com/steveyegge/beads/main/scripts/install.sh | bash"
+}
+
 // localVersionFile is the gitignored file that stores the last bd version used locally.
 // Must match the constant in version_tracking.go.
 const localVersionFile = ".local_version"