fix(deps): preserve deployment ownership during reconciliation

[wolfy-j]

Summary

• separate dependency-control closure, module provenance, and operation planning from the dependency handler
• distinguish deployment package ownership from dependency graph authority during expand and stored-resolution reconciliation
• preserve application-owned roots, policies, environment, and UI entries during rollback while removing departing dependency modules
• unregister departing embedded packs from the live graph
• treat DependencyRoot promotion and demotion as semantic registry changes

Regression coverage

• owned deployment roots seed their declared dependency graph without granting control over the deployment package
• current, target, and desired graphs compose into one bounded reconciliation authority
• ApplyVersion removes a departing module and embedded pack, preserves deployment-owned entries, and allows a follow-up install
• immutable artifact normalization remains quiet while real host data drift is restored once
• operation planning is covered for controlled deletion, live dependents, mutable boundaries, root transitions, convergence, and idempotence

Validation

• go test ./... -count=1
• go test -race ./boot/deps/hub ./system/registry/... -count=1
• make lint
• supported local Kickside: Knowledge, KB10 migrations, and Webscout install successfully
• deliberate no-FTS local Kickside: KB10 migration fails, registry rolls back, admin/Keeper remain available, governance stays running, and Webscout installs afterward

Process-host hot-update semantics are intentionally not included and will be handled in a separate PR.