feat(v1.99 PR-17): package-install target detection + preflight deepening

[itcmsgr]

Summary

Second PR in the v1.99 Update Engine Canonization track. Deepens G3-U4 with package-install target detection + two new preflight checks + planning-only RecoveryPlan metadata. No mutation, no apply logic — apply stays deferred to PR-18.

Architecture constraint (INV-U-001) remains intact: update is still a bounded trigger into the rebuild/lifecycle pipeline.

Scope

In scope

• DetectInstallOrigin — probes rpm -q / dpkg -s / NFTBAN_SOURCE_DIR env to classify "rpm" / "deb" / "source" / "". Family-level discrimination only — no point-release branching. Mirrors the existing shell _detect_install_type helper so the Go and shell paths agree until PR-21 removes the shell path.
• DetectPackageTarget — queries rpm -q / dpkg -s for target version. Tries both nftban-core and legacy nftban package names (matches shell behaviour).
• DetectVersions — extended with origin param; source tree wins over package query so explicit --source-dir is always honoured.
• P-6 rebuild_recovery_available — terminal prior state + ip nftban + nft binary present. Warning-severity.
• P-7 install_origin_coherent — declared flag vs detected origin match. Warning-severity.
• RecoveryPlan — new planning-only metadata surface: Available bool, Mechanism string (=rebuild), Notes. PR-18 consumes this per INV-U-002.
• Plan rendering shows the Recovery block.
• Auto-detect origin in update_dryrun.go when operator didn't pass --rpm/--deb/--source.

Explicit non-scope (per spec + user guidance)

• No payload mutation
• No apply logic
• No rebuild switch changes
• No shell update path deletion (PR-21)
• No .conf.local write path changes
• No config delivery changes
• No rollback execution — planning/metadata only

Design discipline — no point-release branching

Per design principle codified in target.go package doc:

This package intentionally classifies at the level of "install origin" (rpm / deb / source) only. It does NOT branch on distro point releases (Ubuntu 22.04.1 vs 22.04.5, AlmaLinux 9.3 vs 9.5, etc.) because no behavioural difference in the update trigger path changes with point releases — the package manager is the stable discriminator.

Same discipline already used by internal/installer/detect/distro.go (only ID branches, VersionID is metadata) and payload.isDebianFamily.

Reuse, not duplication

DetectInstallOrigin is the Go mirror of cli/lib/nftban/cli/cmd_update_detection.sh::_detect_install_type. Both probe the same package managers in the same order and return the same origin strings. Until PR-21 removes the shell, both must stay in sync.

Test plan

• 11 new unit tests: origin detection (rpm/deb/source/unknown), target detection (rpm/deb/not-owned/unknown), version fallback logic, P-6/P-7 paths, BuildRecoveryPlan happy/no-state/in-progress
• CI gate extensions: G3-U4 now asserts all 7 preflight checks; new G3-U4-deepen step verifies Recovery block renders
• Manual lab dry-run on Ubuntu 24.04 + AlmaLinux 9 after CI passes

Sub-gate coverage

Gate	What this PR does
G3-U2 deepen	target detection now works for package installs, not just source
G3-U4 deepen	7 preflight checks (was 5); recovery metadata surfaced

Closure chain

• PR feat(v1.99 PR-16): update trigger → lifecycle/rebuild integration (G3-U1..U4) #473 (PR-16) → main ca488844
• PR release: v1.98.2 — runtime correctness patch (R-1 + R-2 + R-3 + G-CI-1) #472 (v1.98.2) → main 60383f01

Draft — standard PR-draft pattern for v1.99 track, un-drafts after CI green.

🤖 Generated with Claude Code

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None