docs(progress): X6 trust probe merged (PR #33) (#34)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: gustavobertoi

PROGRESS.md

@@ -71,7 +71,7 @@ satisfied phases; `--json` matches the spec contract; `down` decrements refs;
 - [ ] X3 hooks full — TODO  *(ready: X1,C4 in)*
 - [ ] X4 profiles/selective-up — TODO  *(ready once X2 lands; X1 in)*
 - [ ] X5 orchestrate completion — BLOCKED (X2,X3,X4)
-- [ ] X6 `internal/doctor` full matrix + `--fix` — TODO  *(ready: C8,N2,N3 in)*
+- [~] X6 `internal/doctor` full matrix + `--fix` — **PARTIAL**: trust probe added (PR #33). Remaining: dns/shared probes + safe `--fix`.
 - [ ] X7 `workspace destroy`/`uninstall` — BLOCKED (S5,X6)
 - [x] X8 self-update notifier — **DONE** (PR #25, `28c4a78`)
 - [ ] X9 `internal/migrate` + `import` — TODO
@@ -100,3 +100,4 @@ satisfied phases; `--json` matches the spec contract; `down` decrements refs;
 - (night 2 cont.) **X1 merged** (PR #27, `1c77d44`) — config completion: `Service.MemoryMB` + `Workspace.MemoryBudgetMB` (spec 12/18) and `validateProfiles` (groups reference real services; `defaultProfile` names a defined group or reserved `all`), positioned. Unblocks **X2 (health DAG), X3 (hooks full), X6 (doctor matrix)** — all now ready; X4 waits on X2. **27 PRs merged this session.** Remaining for `done`: N5; S2–S6; provision saga phase (host-port coupling); X2–X7+X9; G2–G5.
 - (night 2 cont.) **proxy labels wired into generate** (PR #29, `d0e04e8`, N5 part 1) — `proxy.LabelsForService` → caddy-docker-proxy labels merged onto routed services in `buildProjectService` (no-op when proxy disabled, golden/determinism unchanged). The proxy feature (N1 route table → labels) is now end-to-end. **29 PRs merged this session.** N5 remaining = saga trust phase + doctor trust/dns probes. Broad frontier still open: S2–S6, provision saga phase (host-port coupling), X2/X3/X4/X6/X7/X9, G2–G5.
 - (night 2 cont.) **S2 merged** (PR #31) — SOPS+age secrets provider (shells `sops -d --output-type json`, batch-per-file, `RegisterBuiltins`), fake-runner tested (sops not on the runner yet). **M4 has S1+S2; S3/S4/S5/S6 now ready.** **31 PRs merged this session — M2 complete; M4 S1/S2; M5 N1–N4 + proxy-generate; M6 X1/X8; M7 G1 + CI/tests overhaul.** Remaining for `done`: S3–S6, the provision saga phase (host-port coupling), N5 trust phase + doctor probes, X2/X3/X4/X6/X7/X9, G2–G5.
+- (night 2 cont.) **X6 trust probe merged** (PR #33) — `doctor` now reports local-CA readiness (mkcert/CA/certutil) as a non-fatal warning with remediation (decision-#3 self-verify for N2). **33 PRs merged this session.** X6 remaining: dns/shared doctor probes + a safe `--fix`. Frontier for `done`: S3–S6, provision saga phase (host-port coupling), N5 trust saga phase, X2/X3/X4/X5/X7/X9, G2–G5.