fix(doctor): keep local adoption credential checks read-only [skip ci]

Skip credential inspection when an explicit route rules out Ollama adoption. For diagnostic adoption, resolve credential presence through the existing read-only path; exec keeps its ordinary resolver. Preserve the legacy secret store on both configured and unconfigured routes.

Refs #7115 (CW-7583). Frozen mixed tree at 57e957f186: explicitly built CLI SHA256 35de7b5ec4e7a3f3191fd5770384c2a09fee357aec59ab30bc8f7bb07ca40ad3; the existing diagnostic case passed with configured loopback and unconfigured legacy-key scenarios; 9 local Ollama cases and one route diagnostic case passed. Format and diff checks passed. A previous failing rerun used a stale CLI binary and is not proof against this change; real Ollama and release qualification remain open.

crates/tui/src/lib.rs

@@ -2850,7 +2850,8 @@ async fn run_async_main_dispatch(
                     if !explicit_route_override
                         && !fleet_route_applied
                         && let Some(tag) =
-                            crate::local_ollama::adopt_live_local_ollama_for_run(&mut config).await
+                            crate::local_ollama::adopt_live_local_ollama_for_run(&mut config, false)
+                                .await
                     {
                         eprintln!(
                             "codewhale exec: no cloud API key, so this run uses local Ollama {tag}; nothing was saved."
@@ -5039,7 +5040,7 @@ async fn run_doctor(
     println!("{}", "==================".truecolor(sky_r, sky_g, sky_b));
     let local_route = if probes.probe_local {
         let mut local = config.clone();
-        crate::local_ollama::adopt_live_local_ollama_for_run(&mut local)
+        crate::local_ollama::adopt_live_local_ollama_for_run(&mut local, true)
             .await
             .map(|tag| (local, tag))
     } else {

crates/tui/src/local_ollama.rs

@@ -81,14 +81,20 @@ pub(crate) fn startup_route_configured(config: &Config) -> bool {
         || config.active_route_endpoint_configured()
 }
 
-pub(crate) async fn adopt_live_local_ollama_for_run(config: &mut Config) -> Option<String> {
+pub(crate) async fn adopt_live_local_ollama_for_run(
+    config: &mut Config,
+    read_only: bool,
+) -> Option<String> {
     let provider = config.active_provider_identity().ok()?.provider;
-    if !should_adopt_live_local_ollama(
-        startup_route_configured(config),
-        provider,
-        false,
-        !crate::provider_readiness::has_api_key(config),
-    ) {
+    if !should_adopt_live_local_ollama(startup_route_configured(config), provider, false, true) {
+        return None;
+    }
+    let has_key = if read_only {
+        config.active_route_api_key_read_only().is_ok()
+    } else {
+        crate::provider_readiness::has_api_key(config)
+    };
+    if has_key {
         return None;
     }
     let catalog = spawn_local_ollama_adoption_probe(config, true)?

crates/tui/tests/integration/diagnostic_read_only.rs

@@ -511,6 +511,27 @@ fn doctor_text_probe_uses_a_legacy_key_without_migrating_it() {
         legacy_before,
         "doctor must not rewrite the legacy secret store"
     );
+
+    fs::write(&config, "").expect("write unconfigured route");
+    let output = diagnostic_command(&workspace, &home)
+        .args([
+            "--config",
+            config.to_str().expect("config path"),
+            "doctor",
+            "--probe-local",
+        ])
+        .env("CODEWHALE_DISABLE_LOCAL_OLLAMA_PROBE", "1")
+        .env("CODEWHALE_DISABLE_MODELS_DEV_FETCH", "1")
+        .env("CODEWHALE_DISABLE_CLOUD_FACTS", "1")
+        .env("CODEWHALE_NO_UPDATE_CHECK", "1")
+        .output()
+        .expect("run doctor with unconfigured route");
+    assert!(output.status.success(), "unconfigured doctor probe failed");
+    assert!(
+        !primary.exists(),
+        "credential inspection must not migrate the store"
+    );
+    assert_eq!(fs::read(&legacy).expect("legacy preserved"), legacy_before);
 }
 
 #[test]