merge: integrate proxyctl ticket 07

# Conflicts:
#	cmd/proxyctl/main.go
#	internal/securefs/securefs.go

internal/target/target.go

@@ -38,6 +38,19 @@ type OperationResult struct {
 	Err        error
 }
 
+// Check is one read-only diagnostic observation with the evidence behind it.
+type Check struct {
+	Name     string
+	OK       bool
+	Evidence string
+}
+
+// Diagnosable is the optional Target capability for command and write-authority
+// checks which cannot be inferred from availability and inspection alone.
+type Diagnosable interface {
+	DiagnosticChecks(context.Context, *profile.Profile) []Check
+}
+
 // Target hides platform paths and commands from the application and TUI.
 type Target interface {
 	ID() string