feat(diff,engine): UserEnvSwitch.config_hash + state.toml [[managed.user_env]]

[UnbreakableMJ]

Summary

Plan §6.3 + §7.4 W2 — closes the M3 W2 user-env loop. Each UserEnvSwitch now carries the plan-time config_hash; the engine records (user, generation, config_hash) into state.toml after each successful switch, so the next pearlite plan sees no drift on a clean re-apply.

Changes

• Action::UserEnvSwitch gains config_hash: String. Non-empty in the normal first-apply / drift path, empty sentinel in the defensive "declared HM enabled but config_path missing on disk" arm. The sentinel propagates verbatim; the next plan recomputes and re-applies (correct behaviour for that edge case).
• UserToSwitch (diff classifier intermediate) gains the same field; classify_user_env populates from declared_user_env_hash[user]. compose::user_env_actions threads it into the Action.
• Engine::apply_plan grew a Vec<UserEnvRecord> accumulator that exec_action's UserEnvSwitch arm pushes to after a successful switch. The phase-9 commit calls a new upsert_user_env_records helper that replaces an existing record by user-name (rather than appending duplicates).

upsert_user_env_records is "last write wins" by user. within_phase_key already dedupes by login name in the action ordering, so this is belt-and-braces.

Test plan

• Two new engine tests:
  • user_env_record_upserts_on_re_apply — first apply records (alice, gen=1, hash=v1); second apply with hash=v2 replaces the entry rather than appending.
  • user_env_switch_dispatches_through_home_manager extended to assert state.toml's managed.user_env grew the expected pair of records (alice + bob with their respective config_hashes).
• Two new diff classifier tests:
  • user_to_switch_carries_declared_fields checks config_hash == "" for the no-hash path.
  • user_to_switch_carries_declared_hash_when_available verifies the hash from declared_user_env_hash propagates to the action.
• Existing 5 UserEnvSwitch literals across diff + engine tests updated to pass the new config_hash field.
• cargo fmt --all -- --check, cargo clippy --workspace --all-targets --all-features -- -D warnings, full workspace cargo test, SPDX, pearlite-audit check . all green.

🤖 Generated with Claude Code