feat: add modular ONEScript launcher

[RomeoRaven]

Summary

• add a thin manifest-driven onescript CLI with list, info, run, batch, doctor, and TTY menu modes
• preserve all four diagnostic modules as independently runnable scripts
• add seven-field catalog metadata, strict path and symlink validation, checksum coverage, and documentation
• process valid final catalog rows even when the file has no trailing newline
• extend pinned ShellCheck and behavioral CI coverage

Safety

• no diagnostic logic is duplicated in the launcher
• no downloads, package installation, remediation, sourcing, or argument evaluation
• linked catalogs, module directories, and module files are rejected
• no merge, tag, or release is part of this PR review step

Verification

• launcher suite: 92 passed, 0 failed
• integrated suite: 102 passed, 0 failed
• no-final-newline catalog regression: passed for list, info, run, and doctor
• pinned ShellCheck: passed
• onescript doctor: passed
• SHA-256 verification: passed
• GitHub CI: passed
• independent final review: PASS with no blockers