Add local-env six-phase pipeline orchestrator

The orchestrator runs the layers in order (preflight → resolve → fetch →
merge → provision → validate), records per-phase status into Result, and
returns typed PipelineErrors carrying FailurePhase and DiskMutated. Under
--check it computes and reports the plan (with a diff) and performs no
writes — skipping the writability probe and package-manager availability,
neither of which is needed to compute the plan.

Backups are created only when no .bak exists and the original is a genuine
os.ErrNotExist-free read; an unreadable or unstattable existing file fails
loudly rather than being misread as greenfield and overwritten.

Stacked on the package-manager/detection layer; provisions through the
PackageManager interface against a fake in tests.

Co-authored-by: Isaac

Author: rugpanov