Builds install plans from live host surface analyzers.

--check and --dry-run classify drift from current disk and package desired state only. Stored manifest fingerprints never override entry :fingerprint. manifest_state and optional per-entry manifest_fingerprint are reporting-only.