MANUAL RUN: dependency doctor on-fail chain, what needs a real claude and a browser (#873) #1642

Left over from #873 once the fake-backed tests covered the rest (rollback, hold-back, alert-once, dollar cap and the report text are all in test/deps.test.ts and test/client.test.ts).

• Chips in a browser: tapping toggles, ‹ moves a step earlier, save and reload keeps the order, nothing wraps at phone width.
• Real claude: with --output-format json, edits still come back and a $ cost shows on 🤖 and 🔎 hover; 🔎's answer names a source it found.
• Hosted (admins): redeploy for the new sandbox/server.mjs, check 🔎 passes the egress gate with no new hosts and the cost adds up.
• 🔔 on macOS: one system notification, not repeated on the next run.