Survey the machine, and say what an install would do to it

The first two pieces of the installer, and deliberately the two that change
nothing: what this machine is, and what would happen to it.

The survey is the floor under every later choice -- a component can only
offer a container shape if Docker answers for this user, or a host shape on
a systemd machine with what that shape needs. It reports what it could not
establish as unknown rather than guessing: an unprivileged probe of port 25
means "I may not bind this", not "something is listening", and reporting
the first as the second is a lie an operator would act on.

The plan is one list, and it will have three readers: --dry-run prints it,
the interface will show it before anything happens, and apply will walk it.
What you are shown is what runs.

Tested on a fresh Debian 13 in qemu, which has neither Docker nor Node and
so exercises every unavailable shape: 23 checks, including that nothing was
created by any of it. The lab that machine runs in is in e2e/vm.

e2e/vm/down.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+# SPDX-FileCopyrightText: 2026 Coffey Labs
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# Stop the lab machine and remove its disks. The base image stays, so up.sh
+# is quick the next time; --all takes that too.
+set -euo pipefail
+LAB="${LAB:-$HOME/.cache/inbuxa-lab}"
+SSH_PORT="${SSH_PORT:-2222}"
+DISK="$LAB/lab.qcow2"; CLEAN="$LAB/lab-clean.qcow2"; SEED="$LAB/seed.iso"
+LOG="$LAB/console.log"; PIDFILE="$LAB/qemu.pid"
+. "$(dirname "$0")/lib.sh"
+
+vm_stop
+rm -f "$DISK" "$CLEAN" "$SEED" "$PIDFILE" "$LAB/monitor.sock"
+[ "${1:-}" = "--all" ] && rm -rf "$LAB"
+echo "==> gone"