fix(auth): harden unified diagnostic execution

tools/tht/internal/doctor/report.go

@@ -155,27 +155,36 @@ func RunWithProbe(ctx context.Context, installation config.Installation, runner
 
 	status, statusAvailable, servicesCheck := serviceStatus(ctx, installation, runner, secretValues)
 	coreRunning := false
+	coreHealthy := false
 	if statusAvailable {
-		var err error
-		coreRunning, err = service.CoreRunning(status)
-		if err != nil {
+		var runningErr, healthyErr error
+		coreRunning, runningErr = service.CoreRunning(status)
+		coreHealthy, healthyErr = service.CoreHealthy(status)
+		if runningErr != nil || healthyErr != nil {
 			coreRunning = false
+			coreHealthy = false
 		}
 	}
 	if !configReady || !coreRunning {
 		add("authentication", StatusSkipped, "core is unavailable")
+	} else if !coreHealthy {
+		add("authentication", StatusFailed, "core is running but unhealthy")
 	} else if authenticationCheck(ctx, installation, runner, secretValues) {
 		add("authentication", StatusPassed, "container-local authentication diagnostics passed")
 	} else {
 		add("authentication", StatusFailed, "container-local authentication diagnostics failed")
 	}
 	add(servicesCheck.Name, servicesCheck.Status, servicesCheck.Detail)
-	if !coreRunning {
-		add("core-http", StatusSkipped, "core is not running")
-		add("frontend-http", StatusSkipped, "core is not running")
-		add("workspace-registry", StatusSkipped, "core is not running")
-		add("workflow", StatusSkipped, "core is not running")
-		add("pi", StatusSkipped, "core is not running")
+	if !coreHealthy || servicesCheck.Status != StatusPassed {
+		detail := "required services are not healthy"
+		if !coreRunning {
+			detail = "core is not running"
+		}
+		add("core-http", StatusSkipped, detail)
+		add("frontend-http", StatusSkipped, detail)
+		add("workspace-registry", StatusSkipped, detail)
+		add("workflow", StatusSkipped, detail)
+		add("pi", StatusSkipped, detail)
 		return finalize(report), nil
 	}