Opt-in binding of a reviewed preview to the applied plan (plan confirmation)

[ekalb81]

Problem

Preview and apply are separate invocations, and the plan is recomputed from live registry and filesystem state at apply time (~line 438). The -Apply run does re-print the full plan it is about to write in the same invocation, so what is shown is what is applied — but nothing binds the earlier reviewed preview to the later apply. If PATH or the filesystem changed in between, the applied result can differ from what the user reviewed, and only re-reading the second printout catches it.

Proposed fix (enhancement, opt-in)

• Preview mode prints a short stable hash of the proposed plan (e.g. SHA-256 over the ordered proposed entries per scope, truncated).
• New optional parameter, e.g. -ExpectedPlanHash <hash>: when supplied with -Apply, the script recomputes the plan, hashes it, and refuses to write if the hash differs, telling the user to re-review.
• Default behavior unchanged when the parameter is omitted.

Acceptance criteria

• Hash is deterministic across runs for identical plans and insensitive to display formatting.
• Mismatch aborts before backup creation and any write.
• Tests: matching hash proceeds (seam-based), mismatched hash aborts, omitted parameter unchanged.

Priority: P3 — hardens the review workflow; not a defect in current behavior.