fix(doctor): expose executing package version

[Wibias]

Summary

Make doctor --json report the version of the currently executing npm package, separately from the installed managed skill and the latest GitHub release.

Why

The newest Grok trace and the recent npx github-delivery incident exposed an ambiguity:

• managed installation can be v1.5.3
• latest stable release can be v1.6.0
• the npx runtime can still be an older cached package

Previously doctor exposed the first two identities but not the third, which made a stale runtime look like a broken v1.6.0 parser.

Contract

Doctor now includes:

"runtime": {
  "packageVersion": "1.6.0",
  "relationToLatest": "already_current"
}

This is diagnostic-only and read-only.

Trace evidence

The uploaded trace contains 968 events but no trace_metadata record and uses raw provider IDs, despite current releases emitting version/digest metadata and pseudonymizing IDs. Explicit runtime identity makes this stale-runtime condition visible immediately.

No merge or release publication is authorized by this PR.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 52e3e93d-ae08-40d0-b350-e6f111da40fd

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}