doctor: extend probeRoots() beyond 7/42 providers to kill the silent-zero class

Motivation

#874's real lesson was not the missing provider, it was the silence: Cline CLI usage was reported as $0.00 with no signal anywhere, not even --verbose, and the reporter had to reverse-engineer discovery to learn why. probeRoots() was added there so codeburn doctor can distinguish "tool not installed" from "override points at an empty directory" from "sessions found".

That capability currently covers 7 of the 42 providers. The other 35 keep the silent-zero failure mode: any of them whose data directory moves, whose env override is stale, or whose product update relocates storage will just quietly contribute nothing, and the user's headline will disagree with reality with no diagnostic anywhere.

Proposal

Extend probeRoots() across the provider fleet, in tiers:

1. Tier 1 - env-overridable local-dir providers (the exact #874 shape): every provider with a PROVIDER_ENV_VARS entry should report its resolved root(s). The env override being wrong is the most common silent-zero cause and the cheapest to detect.
2. Tier 2 - fixed-location providers: report the well-known path and whether it exists. Still valuable: product updates move storage (the ChatGPT desktop schema churn in #234 is the extreme case of this class).
3. Network providers: out of scope; their failure modes are auth errors, which already surface.

Each implementation is mechanical (return the resolved discovery roots with a label), so this is a good campaign to run incrementally: a batch of 5-8 providers per PR, doctor output reviewed once at the start for format.

If the direction is agreed, I can start with Tier 1 (the PROVIDER_ENV_VARS set minus the 7 already covered) and keep PRs small.