perf(cli): stream-scan last session audit_degraded in doctor

[christopherkarani]

Summary

• ryk doctor no longer readFileAllocs last-session events.jsonl (up to 64MiB) just to detect "type":"audit_degraded".
• Stream-scans a 4KiB stack window with needle.len-1 overlap; cap still max_audit_log_len.
• Detection kept. Fail-open on join/open/read errors kept (doctor must not crash on missing evidence).

Fixes #411

Test Plan

• ./scripts/zig build test-lib -Dtest-filter=lastSessionAuditDegraded (worktree /tmp/ryk-factory-wt-411) — 24 tests passed, including:
  • pointed-at session detects audit_degraded
  • empty/whitespace .ryk/last and missing events → false
  • needle after 12KiB pad → true
  • needle split across 4KiB chunk → true

Notes

• Offline doctor UX only. No hook/evaluate/policy/sandbox change.
• No secrets. No protection-grade wording change.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[christopherkarani]

REVIEW_PACKET pr=502 verdict=APPROVE findings=0

Adversarial review. Orchestrator did not write product code. A2A ryk-review/ryk-test down (only :9900 up).

Scope

src/cli/doctor.zig only. Stream-scan last-session events.jsonl for "type":"audit_degraded" instead of readFileAlloc (64MiB). Offline doctor UX. No hook / evaluate / policy / sandbox change.

Hard-fail checks

• Fail-closed: N/A (doctor). Fail-open on join/open/read still returns false. Unchanged.
• Deny not softened. Residual ask not rewritten.
• Grade honesty: no protection-grade wording. Still a doctor health line.
• Secrets: none.
• Cap: still max_audit_log_len. Needle unchanged.

Stream-scan

4KiB stack window + needle.len-1 overlap. Split-across-chunk and post-12KiB cases are tested. Same substring match as before.

Gates

• Path gate: agent-gate.sh --paths src/cli/doctor.zig → test-fast.sh units
• ./scripts/zig build test-lib -Dtest-filter=lastSessionAuditDegraded → 24/24 (all 4 lastSessionAuditDegraded tests OK)
• test-fast.sh units: 2669 passed / 37 skipped / 18 failed — daemon_trust / host_identity / cli.run under world-writable /tmp. Known host noise. Not this diff.

Stamping review:approve + test:pass. merge_ready still needs GitHub CI CLEAN.