feat(cli): openctl plan — batch $ref dependency preview (K7)

[astrojerms]

K7 — batch plan-preview (openctl plan)

Adds openctl plan -f <files|dirs>: load a set of manifests and preview the apply order derived from their $ref markers — what will happen, in what order, and what waits on what — before any apply, with no controller connection.

$ openctl plan -f examples/homelab/
Plan: 11 resource(s), 2 wave(s)

Apply order:
  wave 1:
    Cluster/home
    Tunnel/home
  wave 2:
    DNSRecord/chat  ← Tunnel/home
    HelmRelease/ollama  ← Cluster/home
    Platform/home  ← Cluster/home
    ...

How

• internal/plan — a pure package that builds the cross-resource dependency graph via the same refs.Collect primitive the dispatcher uses (keyed on the full apiVersion|kind|name triple, so same-Kind/Name across providers don't collide), topologically sorts it (Kahn) into waves — resources in a wave have no inter-dependency and can apply concurrently — records each node's direct deps and any $ref targets outside the set (must already exist), and errors on a dependency cycle naming the stuck resources.
• internal/cli/plan.go — the command plus a batch loader that walks directories recursively and dispatches .cue → LoadCUE, .yaml/.yml → LoadMultiple.

Verification

• Validated live by planning the shipped examples/homelab/ set (11 resources → 2 waves).
• Unit tests: chain / diamond / external-ref / cycle / duplicate-identity / same-Kind+Name-distinct-apiVersion / no-refs; the batch loader (dir walk, multi-doc YAML, unsupported ext, missing path); and rendered output.

Remaining (tracked in ROADMAP)

• Per-resource dry-run --diff is server-only (needs the controller's DryRunApply: drift vs stored last-applied + live provider Get) — deferred.
• A batch RPC to expose the same DAG to the UI.
• Pairs with I1 (plan-on-PR: render this preview on a PR).

Local CI: build, go test ./... (+-race on plan), gofmt, vet, staticcheck, golangci-lint (0 issues), modernize — all green.