Typed cass doctor command boundary.
The safety-critical doctor executor is intentionally reached through this module so legacy flag spellings and future subcommands share one command model before any repair code can run.