[VPEX][5b] Add local-env six-phase pipeline orchestrator (#5851)

## Why

- The earlier layers (resolve / fetch / merge) need an orchestrator that
runs them in order, reports structured per-phase status, and provisions
the environment — without mutating disk in `--check` dry-run mode.
- This is the core half of the split described in #5850: the six-phase
pipeline itself, stacked on the package-manager/detection layer.

## What

- **`pipeline.go`** — the six-phase orchestrator (`preflight → resolve →
fetch → merge → provision → validate`). It records per-phase status into
`Result` and returns typed `PipelineError`s carrying `FailurePhase` and
`DiskMutated`. Under `--check` it computes and reports the plan (with a
diff) and performs no writes, skipping the writability probe and
package-manager availability (neither is needed to compute the plan).
- The merge base is the **live `pyproject.toml`**. `MergeManaged`
rewrites only the three managed regions and is idempotent on its own
output, so a re-run preserves edits the user made between syncs. The
`.bak` is a one-time safety copy of the pre-sync original (created only
when none exists, on the first sync of an existing project); an
unreadable or unstattable existing file fails loudly rather than being
misread as greenfield and overwritten.
- `constraints-only` stops *managing* the databricks-connect pin rather
than removing it: a greenfield project renders `dev = []` (no
databricks-connect), and an existing project that already pins
databricks-connect keeps its pin untouched.

## Testing strategy

- End-to-end unit tests of the phase machine against a fake
`PackageManager` + stub compute + `httptest` server: `--check` mutates
nothing (even on a read-only dir / without a package manager) and
reports a plan that matches a real re-run (no spurious backup, empty
diff when idempotent), greenfield vs. existing, the merge basing on the
live file so between-sync edits survive, backup safety on
unreadable/unstattable files, constraints-only behavior, preflight exits
(`E_MANAGER_UNSUPPORTED` / `E_UV_MISSING`), and phase/error attribution
(`pipeline_test.go`).
- Gates: `go build`, `go test`, `golangci-lint` (0 issues), `deadcode`,
`gofmt` — all green.

---

## About this stack

**Review bottom-up.** This PR targets #5850 as its base, so its diff
shows only the pipeline layer.

This PR and #5850 together supersede #5828.

This pull request and its description were written by Isaac.

Author: rugpanov