fix: make doctor read-only and add assisted.yml check

Doctor sources common.sh which unconditionally runs sync_config_files,
writing to the working tree. Add SKIP_CONFIG_SYNC guard so doctor
honours its read-only contract. Also add a missing assisted installer
config section so `make doctor fencing-assisted` validates vars/assisted.yml.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: fonta-rh

deploy/common.sh

@@ -63,7 +63,9 @@ function sync_config_files() {
     done
   done
 }
-sync_config_files
+if [[ "${SKIP_CONFIG_SYNC:-0}" != "1" ]]; then
+  sync_config_files
+fi
 
 if [[ -f "${COMMON_DIR}/aws-hypervisor/instance.env" ]]; then
   # shellcheck source=/dev/null

deploy/openshift-clusters/scripts/doctor.sh

@@ -22,6 +22,8 @@ INSTANCE_ENV="${DEPLOY_DIR}/aws-hypervisor/instance.env"
 # common.sh provides the color constants, msg_* helpers, and env defaults, but
 # unconditionally sources instance.env; silence that noise when instance.env
 # does not exist yet (its absence is reported as a proper check below).
+# SKIP_CONFIG_SYNC: doctor is read-only — suppress the automatic config sync.
+export SKIP_CONFIG_SYNC=1
 if [[ -f "${INSTANCE_ENV}" ]]; then
   # shellcheck source=/dev/null
   source "${DEPLOY_DIR}/common.sh"
@@ -87,6 +89,7 @@ usage() {
 TARGETED=0
 NEED_DEVSCRIPTS=0
 NEED_KCLI=0
+NEED_ASSISTED=0
 REQUIRED_TOPOLOGIES=" "
 
 for arg in "$@"; do
@@ -99,6 +102,7 @@ for arg in "$@"; do
       # assisted deploys the hub via fencing-ipi, so it needs the dev-scripts config
       TARGETED=1
       NEED_DEVSCRIPTS=1
+      NEED_ASSISTED=1
       REQUIRED_TOPOLOGIES+="fencing "
       ;;
     arbiter-ipi|arbiter-agent|fencing-ipi|fencing-agent|sno-ipi|sno-agent)
@@ -378,6 +382,29 @@ else
   fi
 fi
 
+# --- assisted installer configuration ---
+
+section "assisted installer configuration"
+
+ASSISTED_VARS="${DEPLOY_DIR}/openshift-clusters/vars/assisted.yml"
+
+if [[ "${NEED_ASSISTED}" -eq 0 && ! -f "${ASSISTED_VARS}" ]]; then
+  check_note "section skipped: no assisted config detected (vars/assisted.yml) - only needed for fencing-assisted deployments"
+else
+  if [[ -f "${ASSISTED_VARS}" ]]; then
+    check_pass "vars/assisted.yml present"
+    SPOKE_NAME="$(sed -nE 's/^spoke_cluster_name:[[:space:]]*"?([^"]+)"?.*/\1/p' "${ASSISTED_VARS}" | head -1)"
+    if [[ -n "${SPOKE_NAME}" ]]; then
+      check_pass "spoke_cluster_name set to '${SPOKE_NAME}'"
+    else
+      check_warn "spoke_cluster_name not set in vars/assisted.yml (defaults to 'spoke-tnf')"
+    fi
+  elif [[ "${NEED_ASSISTED}" -eq 1 ]]; then
+    check_fail "vars/assisted.yml missing (required for fencing-assisted deployment)" \
+      "cp ${CONFIG_DIR}/assisted.yml.template ${CONFIG_DIR}/assisted.yml and edit it"
+  fi
+fi
+
 # --- Summary ---
 
 echo ""