Read the machine, not the notes: status, and an export that survives them

The state file is intent -- what this installer wrote down that it did. The
machine is reality. They part company more often than is comfortable: a
container stopped by hand, a deployment copied from somewhere else, an
installation made by an older version, a service removed with the runtime
directly. Reporting either one as though it were the other is worse than
reporting nothing, because the operator believes it.

So there are two readings now, shown side by side.

  inbuxa status    what is installed, what is running, where they disagree

It exits non-zero when they disagree, so a machine can be asked in a script
whether it still matches itself.

And export no longer replays the state file. It reads the deployment --
which services the compose file declares, which are up, the mail host
written into the server's hostname and the domain under it -- and uses
intent only for the shapes, which the machine cannot tell you. A deployment
with no state file at all still describes itself, which matters because that
is exactly the machine someone wants to draw: the one that was set up before
any of this existed.

Sixteen checks, on Debian 13 and Rocky 9, including the two that are the
point: a webmail stopped by hand is reported stopped and called out, and a
deployment with the state file deleted still exports a file that plan reads
back and finds nothing to do about.

README.md

@@ -49,6 +49,10 @@ This is early. What is built:
   diffs the file against what is actually installed here and changes
   nothing; `apply` converges to it, adding and removing components;
   `export` writes the file from what is already here.
+- **`status`** -- what is installed, what is running, and where those two
+  disagree: a container stopped by hand, or a deployment nothing recorded
+  installing. It exits non-zero when they disagree, so a machine can be
+  asked in a script whether it still matches itself.
 
 Not built yet: host installs, the terminal interface, `join`, `status`,
 `upgrade`, `uninstall`. The design is in the inbuxa specification (§6.1 and
@@ -76,6 +80,7 @@ is tested on a throwaway virtual machine rather than on anybody's desk:
     e2e/vm/run.sh e2e/cases/install-local.sh   a whole suite, and signing in to it
     e2e/vm/run.sh e2e/cases/install-public.sh  the same with real ports and certificates
     e2e/vm/run.sh e2e/cases/topology.sh       growing and shrinking from a file
+    e2e/vm/run.sh e2e/cases/status-export.sh  intent against reality, and the file
     e2e/vm/down.sh                            remove it
 
 Each case starts from a copy of the machine taken when it was new, so a run