Back out app auto-seeding; fix report-status + PCTypesStrict bugs (manifest review)

A deep Fable review of the real manifest corpus (READ-ONLY reference) showed the
manifests are an ENFORCEMENT PROGRAM, not an application inventory, and that
auto-seeding the Applications catalog from entry Type + Name was wrong:

- The catalog ALREADY tracks these apps from the classic-shopdb migration, with
  version histories (PC - DMIS, UDC x11 versions, eMX / eDNC, CLM, CSF, Oracle
  Database, FormTracePak). Seeding from manifest labels created DUPLICATES under
  different names (PC-DMIS 2016 vs PC - DMIS; eDNC (bundles NTLARS) vs eMX / eDNC;
  OpenText HostExplorer ShopFloor vs CSF). It also misclassified config drops
  (eMxInfo.txt) as apps and could never match a PC's reported ARP name.
So the seed-applications command + service are removed. Properly linking
manifest entries to the EXISTING catalog is a curated feature, not label-scraping.

Two REAL bugs the review found are fixed and kept:
- Report status (R4): every healthy cycle runs Always/no-detection scripts the
  engine counts as "installed", so keying self-heal off installed>0 marked the
  common scope selfhealed forever and made 'ok' unreachable. Status now derives
  from explicit per-entry self-heal flags only; the stored flag no longer infers
  from action=='installed'; the client kit doc reflects it.
- PCTypesStrict (R5): the runtime engine has no strict handling (preinstall
  runner only). filters.matches_pctype now applies strict only when phase ==
  'preinstall'; simulate + parity thread the scope phase through; the strict test
  uses a preinstall scope.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

plugins/geenforce/parity.py

@@ -59,9 +59,11 @@ def check_scope(scopename, phase, original, fixtures):
                 k for k in set(co) | set(cr) if co.get(k) != cr.get(k))
             firstdiff = f'entry "{name}" differs on {diffkeys}'
 
-    # Check 2: same entries fire in the same order for each profile.
+    # Check 2: same entries fire in the same order for each profile. Inject the
+    # scope phase so PCTypesStrict is honored only for preinstall (see filters).
     profiles_same = 0
-    for profile in fixtures:
+    for base_profile in fixtures:
+        profile = {**base_profile, 'phase': phase}
         if (applicable_entry_names(orig_apps, profile)
                 == applicable_entry_names(rebuilt_apps, profile)):
             profiles_same += 1