Back out app auto-seeding; fix report-status + PCTypesStrict bugs (manifest review)

A deep Fable review of the real manifest corpus (READ-ONLY reference) showed the
manifests are an ENFORCEMENT PROGRAM, not an application inventory, and that
auto-seeding the Applications catalog from entry Type + Name was wrong:

- The catalog ALREADY tracks these apps from the classic-shopdb migration, with
  version histories (PC - DMIS, UDC x11 versions, eMX / eDNC, CLM, CSF, Oracle
  Database, FormTracePak). Seeding from manifest labels created DUPLICATES under
  different names (PC-DMIS 2016 vs PC - DMIS; eDNC (bundles NTLARS) vs eMX / eDNC;
  OpenText HostExplorer ShopFloor vs CSF). It also misclassified config drops
  (eMxInfo.txt) as apps and could never match a PC's reported ARP name.
So the seed-applications command + service are removed. Properly linking
manifest entries to the EXISTING catalog is a curated feature, not label-scraping.

Two REAL bugs the review found are fixed and kept:
- Report status (R4): every healthy cycle runs Always/no-detection scripts the
  engine counts as "installed", so keying self-heal off installed>0 marked the
  common scope selfhealed forever and made 'ok' unreachable. Status now derives
  from explicit per-entry self-heal flags only; the stored flag no longer infers
  from action=='installed'; the client kit doc reflects it.
- PCTypesStrict (R5): the runtime engine has no strict handling (preinstall
  runner only). filters.matches_pctype now applies strict only when phase ==
  'preinstall'; simulate + parity thread the scope phase through; the strict test
  uses a preinstall scope.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

plugins/geenforce/api/routes.py

@@ -368,6 +368,7 @@ def simulate_scope(scopeid):
         'hostname': request.args.get('hostname'),
         'machinenumber': request.args.get('machinenumber'),
         'cmmversion': request.args.get('cmmversion'),
+        'phase': scope.phase,
     }
     applied, filtered = [], []
     for entry in scope.entries:
@@ -376,7 +377,9 @@ def simulate_scope(scopeid):
             applied.append(entry.name)
         else:
             reasons = []
-            if not matches_pctype(entry_dict, profile['pctype'], profile['subtype']):
+            strict_allowed = profile.get('phase') == 'preinstall'
+            if not matches_pctype(entry_dict, profile['pctype'],
+                                  profile['subtype'], strict_allowed):
                 reasons.append('PCTypes')
             if not matches_hostname(entry_dict, profile['hostname']):
                 reasons.append('TargetHostnames')