Function heading 

pub fn heading(role: Role, style: Style) -> String

The line above the checks: what this machine is set up as.

Separate from report rather than folded into it because the role is read off paths and report is handed findings. Keeping the two apart is what lets the caller’s own resolution — the .choir/config walk, the --auth-file flag — be the thing reported on, which is the same reason run takes its inputs rather than discovering them.