feat(runtime): add provider capabilities and executor routing

[itsmeares]

Summary

• add stable typed capability IDs, support states, validated registry construction, typed lookup helpers, action gating, and defensive registry copies
• correct Instagram Export and Reddit capability declarations without overstating API access or automatic cleanup
• route apply previews and runs through platform-specific simulation providers selected by plan platform and explicit execution mode
• replace Reddit-specific runner readiness with generic platform-keyed runtime connection state
• derive executor identity from the selected provider across previews, lifecycle events, results, TUI output, and audit fields
• keep Instagram assisted manual cleanup separate from apply execution
• add a deterministic fake provider plus built-in Instagram and Reddit regression coverage
• document import, official scan, review, planning, assisted cleanup, simulation, and automatic cleanup as distinct capabilities

Design

The generic apply package now owns only provider contracts, route lookup, runtime state, preview gating, and execution lifecycle behavior. Instagram and Reddit each supply an explicit simulation provider backed by the existing no-op executor. Missing providers, unsupported actions, or unregistered modes block preview; there is no implicit no-op fallback.

Instagram retains local export import and assisted manual cleanup. Reddit retains its read-only official API planner prototype, with developer access still pending. Its connection prerequisite is provider-owned and reads generic runtime state.

Review follow-up

• route Reddit sign-in and scan through the same typed Platform.ActionAvailable gate used by platform details; keyboard and mouse now share the disabled-action path
• keep Reddit connection UI focused on status/actions and render compact Label: support capability rows only on platform detail
• model standalone SkipAction changes as PlanActionEdit, while routed skipped execution events retain mode/executor identity through audit fields
• resolve Provider.Executor exactly once per run, reuse that instance for every action, and fail closed when it is unavailable
• add regression coverage for disabled Reddit capabilities, routed skip identity, audit fields, and stable executor resolution

Compatibility

• cleanup-plan JSON format unchanged
• action statuses and apply event type names unchanged
• no-op result behavior unchanged
• generated and loaded plan flows preserved
• Instagram import/manual cleanup preserved
• Reddit scan/plan flow preserved
• local workspace, audit, history, wipe, release workflow, and binaries unchanged

Deferred to PR 13 and later

• real platform mutations
• automatic cleanup
• retries, backoff, rate limiting, or partial-failure simulation
• durable execution journals or reconciliation
• authentication lifecycle or credential changes
• schema migrations
• new platforms, network calls, scraping, browser automation, telemetry, or cloud services

Validation

• PR Go files: gofmt clean
• go test -count=1 ./...
• go vet ./...
• go build ./cmd/vanish
• scripts/check-safety.sh (executed through a CRLF-clean stdin wrapper on Windows)
• git diff --check origin/main...HEAD
• final audit confirmed one Provider.Executor call site, no blank routed skip identity, no plan JSON changes, and no follow-up docs/release changes

No tags or GitHub Releases were created or modified.