switch plan command to semantic planner

[atkrad]

Summary

• deployah plan now builds a semantic plan and writes it as human text or JSON. It compares the chart with the previous release baseline Helm selected. For an existing release it also compares that baseline with live cluster state.
• --show-secrets reveals Secret values in either format. --detailed-exitcode exits 2 when the plan has effects (resource changes, tasks that change or run, chart CRDs Helm will process), 0 when it has none, and 1 on error. Drift alone exits 0.
• --drift, --raw, and --yaml are removed. --output defaults to human instead of text.

Test plan

• Unit tests added/updated
• Scenario under scenarios/ (if behavior changes)
• nix run .#lint / pre-commit clean
• Manual smoke (command + expected result), if user-facing

Kind end-to-end covers a fresh plan, an unchanged plan after deploy, replica drift, and --detailed-exitcode on a real spec change. Pre-commit passed on the commit.

Labels

• One of: kind/feature, kind/bug, kind/docs, kind/chore
• Add breaking-change if this breaks existing CLI or config behavior
• Add skip-changelog for internal-only PRs that should not appear in notes

Checklist

• Title is short and imperative (matches commit style)
• Docs / CLI help updated when user-facing (README.md, docs/cli/)
• No secrets or local-only paths in the diff

[codecov]

Codecov Report

❌ Patch coverage is 86.53846% with 7 lines in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
internal/cmd/plan/plan.go	86.84%	5 Missing ⚠️
internal/cmd/root.go	71.42%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!