Closes #1116

Summary

Adds hal0 setup --plan (alias --dry-run): resolves the answer file (or
--auto defaults) into a concrete Selections the SAME way the real run
would, then prints a "will create" table and writes NOTHING — no slot TOML,
no first-run sentinel, no pulls, no extension installs. This is the safe
preview / CI-gate surface from handoffs/hal0-setup-answers-spec-2026-07-05.md
§2 and §8.

• New src/hal0/cli/setup_plan.py (kept separate from setup_command.py to
  minimize merge conflicts with the sibling --emit-answers PR installer-setup: hal0 setup --emit-answers round-trip #1117 touching
  the same callback): resolves selections via load_answers (when
  --answers is given) or build_auto_selections (otherwise), then renders:
  • Model store path + free space (shutil.disk_usage, warns below 10 GiB)
  • NPU opt-in
  • Slots table: name, port, resolved model, device/profile ("auto→derive"
    when not explicit), and a port-in-use check (socket bind probe)
  • Extensions to enable
  • ComfyUI capability defaults, if any
• src/hal0/cli/setup_command.py: one new --plan/--dry-run typer.Option
  and one early-return branch — before any run_install/apply_setup call.
• Resolution failures (e.g. a bad answer file) print the error and exit
  non-zero, so --plan is a usable CI gate. An answer file's strict: true
  flag additionally promotes the port-in-use check from a warning to an
  error exit.

Test plan

• uv run ruff format src tests — 635 files unchanged
• uv run ruff check src tests — all checks passed
• uv run ruff format --check src tests — 635 files already formatted
• uv run pytest tests/install/test_setup_plan.py tests/cli/ -q — 265 passed, 3 pre-existing hermes-venv failures (unrelated)
• uv run pytest tests/ -q --ignore=tests/e2e — 4620 passed, 14 known pre-existing failures (hermes venv/wrapper, comfyui phase4, proxmox host detection, container spec, config-url-proxy, models-preview, settings-store) — none touch files this PR changes
• --plan --auto prints the table and makes zero filesystem writes
• --plan --answers <good file> prints resolved slots
• --plan --answers <bad file> exits non-zero with the validation error
• port-in-use is detected and flagged (and errors under strict: true)

🤖 Generated with Claude Code