feat(doctor): add guided repair for missing ownership lock

[dapi]

Problem

In a downstream repository that has a memory-bank/ directory but no memory-bank/.lock, memory-bank-cli update stops with:

memory-bank lock not found

memory-bank-cli doctor correctly reports template.identity_missing and suggests running memory-bank-cli init, but it has no --fix / repair mode. Recovery therefore requires manually locating a clean template checkout and supplying --source, --template-version, and --source-ref.

Proposal

Add an opt-in repair mode to memory-bank-cli doctor (for example, doctor --fix) that can remediate safe, well-defined findings. Initially, support template.identity_missing by generating or restoring memory-bank/.lock through the same validated adoption path used by init.

The command should:

• remain read-only by default;
• show the complete mutation plan with --dry-run;
• require explicit template provenance (--source, --template-version, --source-ref) when it cannot infer it safely;
• avoid overwriting an existing lock or managed content without explicit confirmation/flags;
• report exactly what was changed and recommend committing memory-bank/.lock.

Current workaround

memory-bank-cli init --dry-run \
  --source <clean-template-checkout> \
  --template-version <version> \
  --source-ref <full-commit-sha>

Then rerun without --dry-run, commit memory-bank/.lock, and run update.

Context

Observed with memory-bank-cli 1.4.1 in BrandyMint/merchantly.

[dapi]

Draft PR: #43

Verification performed:

• go test ./...
• go vet ./...
• git diff --check

The repair requires explicit provenance, previews the complete plan with --dry-run, preserves existing locks and conflicting content, and recommends committing memory-bank/.lock.