doctor: tell a network failure from a dead token in gh auth, and close the remaining #100 shapes in a repo #203

Follow-ups to #183:

• gh's human auth status output reports a non-timeout network failure (DNS can't resolve, connection refused) as "X Failed to log in … token invalid". Offline, doctor therefore relays "NOT authenticated". Newer gh (2.102.0 has it; 2.68.1 does not) offers gh auth status --json hosts, whose error field gives the real cause (it always exits 0). Adopt it when available, with the text parser as the fallback.
• Inside a repo, the scoped check (--hostname H, doctor: "gh — found but NOT authenticated" is a false positive when a SECOND gh host is unreachable #100/doctor: 'gh NOT authenticated' is false when a SECOND configured host is unreachable — the aggregate gh auth status exit code is the wrong question #102) is unchanged, so two doctor: "gh — found but NOT authenticated" is a false positive when a SECOND gh host is unreachable #100-shaped cases remain. A timeout on the repo's host still says "NOT authenticated". An inactive account on H with a dead token makes gh auth status --hostname H exit 1 although the active one is fine; --active fixes it, but older gh lacks the flag.