Status: ready-for-agent

# 02 — Doctor selected model/shard with a bounded real forward

## What to build

Add `meshnet-node doctor`. By default it validates only the selected Model Artifact and Shard from flags/config. Reuse the production model-loading/backend execution path and execute a bounded real forward through the selected Shard; a generic Torch allocation or synthetic benchmark is insufficient.

It emits concise human output plus capability-report JSON. Add explicit `--all-recipes` plumbing for support/CI without making ordinary startup validate unrelated/downloaded models. The default tests must inject a fake/lightweight backend; a real-model test is integration-marked and environment-gated with model identity supplied externally.

**Code refs:**

- `packages/node/meshnet_node/cli.py` — subcommand parser and config/flag resolution
- `packages/node/meshnet_node/model_backend.py` — `TorchModelShard`, `encode_prompt`, `forward_bytes`
- `packages/node/meshnet_node/torch_server.py` — production backend construction
- `tests/test_node_startup.py`, `tests/test_real_model_backend.py` — startup/backend test patterns

## Test-first

1. Red: `doctor` reports generic hardware availability as ready without invoking model validation.
2. Red: an injected backend forward failure still produces a success capability.
3. Green: selected model/shard invokes one bounded generic forward and yields success only on completion.
4. Add an `integration`-marked, env-gated test whose model ID/source is configurable; it has no model-specific default.

## Acceptance criteria

- [ ] `meshnet-node doctor` resolves the same selected model/shard/config path as startup
- [ ] Default doctor performs a bounded real forward through the selected shard before reporting success
- [ ] `--all-recipes` is explicit and does not change default onboarding cost
- [ ] Failure returns non-zero, writes a failed capability report, and prints a user-actionable category without raw traceback by default
- [ ] Unit tests require no GPU or model download; a separately marked integration smoke test is model-configurable

## Blocked by

`01-generic-capability-report.md`.