Repeated gx doctor sandboxes were left dirty because essential guardex-managed entries were absent and had to be regenerated each run. This commit captures those repairs so new doctor branches stop repeating the same drift.

Constraint: Keep protected main read-only; changes must flow through agent branch PR

Rejected: Drop doctor-generated changes locally per run | branch state keeps regressing

Confidence: medium

Scope-risk: narrow

Reversibility: clean

Directive: If doctor keeps recreating the same files, merge the first repair branch before rerunning doctor

Tested: gx scan output before/after doctor on main workspace

Not-tested: full npm test suite