record resource changes from previous to desired

[atkrad]

Summary

• Resource changes now compare the previous Helm release with the rendered desired manifest.
• The semantic plan no longer predicts live cluster writes. Diagnostics, ownership, and apply details are gone.
• Creates and updates follow Helm install order. Deletes come after them, in previous release order.

deployah plan still uses the older plan. This does not change that command.

Related

Refs #142
Refs #143

Test plan

• Unit tests added/updated
• Scenario under scenarios/ (if behavior changes)
• nix run .#lint / pre-commit clean
• Manual smoke (command + expected result), if user-facing

Pre-commit ran gofmt, golangci-lint, and the other hooks. go test ./internal/plan/... -race passed. The e2e test compiles. It was not run against a Kind cluster.

Labels

• One of: kind/feature, kind/bug, kind/docs, kind/chore
• Add breaking-change if this breaks existing CLI or config behavior
• Add skip-changelog for internal-only PRs that should not appear in notes

Checklist

• Title is short and imperative (matches commit style)
• Docs / CLI help updated when user-facing (README.md, docs/cli/)
• No secrets or local-only paths in the diff

[codecov]

Codecov Report

❌ Patch coverage is 89.91935% with 25 lines in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
internal/plan/resource_changes.go	89.10%	17 Missing ⚠️
internal/plan/semantic_build.go	83.87%	5 Missing ⚠️
internal/plan/helm_order.go	84.61%	2 Missing ⚠️
internal/plan/namespace.go	88.88%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!