PASS

r2 check:
- tests/scripts/doctor.sh:15 test list tracked doctor's own list: fixed. The test now hard-codes the 11 tools on line 8 and asserts a version line for each one. Re-ran the r2 scenario by deleting `check pkg-config` and `check git-lfs` from a copy of doctor.sh. The test prints `FAIL: no version line for pkg-config` and exits 1.
- tests/scripts/doctor.sh:13 real system tools leaked into the absent case: fixed. Line 14 sets `PATH="$stubs"` only and starts doctor with `"$BASH"`. doctor.sh uses only builtins now, since `head` was replaced by `${out%%$'\n'*}`, so nothing outside the stub directory can be found.

Verified this round:
- `bash tests/scripts/doctor.sh` prints `doctor.sh: present, absent x11, broken pass` and exits 0. It does the same under /bin/bash 3.2.
- `bash scripts/doctor.sh` on this host prints versions for all 11 tools, including cmake 4.4.3, ninja 1.13.2, pkg-config 3.0.7 and git-lfs 3.8.0, and exits 0.
- Mutant with `exit 0` in place of `exit "$failed"`: the test fails with `rustc absent: doctor exited 0`.
- A stub on PATH that is not executable is reported as `BROKEN  cmake: ... Permission denied`, and doctor exits 1.

No new defects in the changed code.