M4 epic: Apply engine

[Andreas-Froyland]

Tracking issue. Dependency and status checklists only — implementation stays in narrow linked issues.

Outcome

An authorized plan converges a machine safely, with approvals, compensation, and post-apply verification.

Supersedes

Replaces the agents-registry sync orchestration portion of #2.

Depends on

• M4 observed/difference/planner
• FM-108/FM-109 — durable operations and worker (M1)
• FM-106 — authorization port and permission catalog (M1)

Scope checklist

• Apply planner with dependency ordering, dry run, and explicit approvals
• Declarative custom actions running through the reviewed recipe runner, permission checks, durable operations, and audit
• Compensation on partial failure and post-apply observation
• Restart/resume preserves truth and audit history

Constrained by

• docs/PLAN.md — M4; ADR-0008
• Recipes are privileged code, not a safe plugin format

Non-goals

• A separate plugin SDK
• Fleet acting as a general package or configuration manager

Implementation issues

• FM-402 — Add the apply engine #91