Optional redacted machine-readable JSON operation report

[ekalb81]

Problem

There is no machine-readable record of what an apply run did; support investigations rely on console scrollback.

Proposed fix (from project backlog, P3)

• Add an opt-in parameter (e.g. -ReportPath <path>) that writes a JSON report containing: selected scopes, proposed and applied changes (added/removed/retained entries per scope), backup file location, and write/verification outcome.
• Do not record unrelated environment variables or anything secret-bearing; the report content is limited to PATH data the run already displays.

Acceptance criteria

• Report written for both apply and restore operations; not written in preview mode unless explicitly requested.
• Schema has a version field.
• Tests covering report content and the redaction boundary.