fix: address code review findings for --doctor backend display

- Gate /dev/kvm fix hints behind _kvm_active check (was leaking
  unconditionally)
- Check COWORK_VM_BACKEND override in --doctor backend summary
  to match daemon's detectBackend() behavior
- Log hint when KVM deps are present but bwrap wins auto-detect,
  so upgrading users know about COWORK_VM_BACKEND=kvm

Co-Authored-By: Claude <claude@anthropic.com>

scripts/cowork-vm-service.js

@@ -1813,6 +1813,12 @@ function detectBackend(emitEvent) {
             stdio: 'pipe', timeout: 5000
         });
         log('Backend: bwrap');
+        // Hint for users upgrading from KVM-first auto-detection
+        try {
+            fs.accessSync('/dev/kvm', fs.constants.R_OK | fs.constants.W_OK);
+            log('Note: KVM is available but bwrap is now the default. '
+                + 'Set COWORK_VM_BACKEND=kvm for full VM isolation.');
+        } catch (_) { /* KVM not available, no hint needed */ }
         return new BwrapBackend(emitEvent);
     } catch (e) {
         log(`bwrap not available: ${e.message}`);

scripts/launcher-common.sh

@@ -490,8 +490,10 @@ print(len(servers))
 			_pass 'KVM: accessible'
 		else
 			"$_kvm_issue" 'KVM: /dev/kvm exists but not accessible'
-			_info "Fix: sudo usermod -aG kvm $USER"
-			_info '(Log out and back in after running this)'
+			if $_kvm_active; then
+				_info "Fix: sudo usermod -aG kvm $USER"
+				_info '(Log out and back in after running this)'
+			fi
 		fi
 	else
 		"$_kvm_issue" 'KVM: not available'
@@ -548,7 +550,13 @@ print(len(servers))
 
 	# Determine active backend (matches daemon's detectBackend())
 	local cowork_backend='none (host-direct, no isolation)'
-	if command -v bwrap &>/dev/null \
+	if [[ -n ${COWORK_VM_BACKEND-} ]]; then
+		case ${COWORK_VM_BACKEND,,} in
+			kvm)  cowork_backend='KVM (full VM isolation, via override)' ;;
+			bwrap) cowork_backend='bubblewrap (namespace sandbox, via override)' ;;
+			host) cowork_backend='host-direct (no isolation, via override)' ;;
+		esac
+	elif command -v bwrap &>/dev/null \
 		&& bwrap --ro-bind / / true &>/dev/null; then
 		cowork_backend='bubblewrap (namespace sandbox)'
 	elif [[ -e /dev/kvm ]] \