cli: init and doctor, and stop one bad project breaking a root

Slices 3 and 5 of docs/cli-design.md.

`init` writes .sl0ppi/layout.kdl. The template is mostly comments, because the
purpose vocabulary and the start_suspended habit are the two things nobody can
guess, and the point of use is the cheapest place to explain them. A test
asserts the template passes doctor's own fragment check -- shipping people a
starting point that fails our validation would be embarrassing.

`doctor` splits into gathering facts (IO) and judging them (pure), so the rules
are testable. It is honest about its limits: sl0ppij has no parse-only mode, so
fragments get a structural check (empty, unbalanced braces, a whole `layout {}`
pasted in, a `tab` node sl0ppi owns) rather than a claim of validity. It also
reports the known packaging hole -- pir needs python3 and fzf, neither of which
is in the tarball.

Driving them for real turned up a worse bug than either command:

  a single broken fragment took down the entire root

On session creation every tab shares one layout file, so one unbalanced brace
made the whole `up` fail and no project opened at all. Fragments are now checked
before use on BOTH paths, broken ones are skipped with the reason, and the rest
open. `up` also registers the root even when some projects failed, since
forgetting it would orphan the tabs that did open.

Two smaller fixes from the same session:

  - falling open with no tty used to spawn a bare sl0ppij, which silently
    CREATES a session; that is where a handful of randomly-named junk sessions
    came from during testing. It now reports and exits.
  - a rename leftover: `setup --check` still described "the configuration of
    zellij".

Test isolation lesson worth recording: sessions live in the runtime dir
(/run/user/1000/sl0ppij), not TMPDIR, so setting TMPDIR alone does not isolate
them -- an earlier test session called `root` was silently reused by a later
test. SL0PPIJ_SOCKET_DIR is what actually isolates.

88 tests green.

1 files changed, 5 insertions, 2 deletions

diff --git a/docs/roadmap.md b/docs/roadmap.md
index 5c49b58..c73a1dc 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -90,8 +90,11 @@ project = one tab keyed by its `project:` tab purpose, panes from a
 Entry point fails open to plain `sl0ppij` so an orchestrator bug can never cost
 you a terminal.
 
-MVP: discovery + idempotent tab diff, `up`/`ls`/`open`/`close`, `init`, doctor.
-Deferred: `agent --resume` (needs the pir port off python3), fuzzy picker.
+MVP is complete: discovery + idempotent tab diff, `up`/`ls`/`open`/`close`,
+`init`, `doctor`, and the fail-open entry point. 88 tests.
+
+Deferred: `agent --resume` (needs the pir port off python3), fuzzy picker for
+tab overflow, root order file, per-project eager.
 
 ## Phase 5 — CI and distribution