Survey the machine, and say what an install would do to it

The first two pieces of the installer, and deliberately the two that change
nothing: what this machine is, and what would happen to it.

The survey is the floor under every later choice -- a component can only
offer a container shape if Docker answers for this user, or a host shape on
a systemd machine with what that shape needs. It reports what it could not
establish as unknown rather than guessing: an unprivileged probe of port 25
means "I may not bind this", not "something is listening", and reporting
the first as the second is a lie an operator would act on.

The plan is one list, and it will have three readers: --dry-run prints it,
the interface will show it before anything happens, and apply will walk it.
What you are shown is what runs.

Tested on a fresh Debian 13 in qemu, which has neither Docker nor Node and
so exercises every unavailable shape: 23 checks, including that nothing was
created by any of it. The lab that machine runs in is in e2e/vm.

e2e/vm/reset.sh

@@ -0,0 +1,23 @@
+#!/bin/bash
+# SPDX-FileCopyrightText: 2026 Coffey Labs
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# Rewind the lab machine to the copy up.sh kept. A few seconds, and the
+# machine is as fresh as a new VPS -- which is what makes a test run free to
+# create users, write units and take ports.
+set -euo pipefail
+LAB="${LAB:-$HOME/.cache/inbuxa-lab}"
+MEM="${MEM:-4096}"; VCPUS="${VCPUS:-2}"; SSH_PORT="${SSH_PORT:-2222}"
+DISK="$LAB/lab.qcow2"; CLEAN="$LAB/lab-clean.qcow2"; SEED="$LAB/seed.iso"
+LOG="$LAB/console.log"; PIDFILE="$LAB/qemu.pid"
+. "$(dirname "$0")/lib.sh"
+
+[ -f "$CLEAN" ] || { echo "no clean copy -- run e2e/vm/up.sh first" >&2; exit 1; }
+
+vm_stop
+cp --reflink=auto "$CLEAN" "$DISK"
+: > "$LOG"
+vm_start
+for _ in $(seq 1 90); do vm_ssh true 2>/dev/null && break; sleep 2; done
+vm_ssh true 2>/dev/null || { echo "no ssh after the rewind; see $LOG" >&2; exit 1; }
+echo "==> clean: ssh [email protected] -p $SSH_PORT"