feat: explain scoped action requirements #36

Provide one shared, bounded requirement evaluator and contextual explanations over current inventory. A satisfied prerequisite is evidence, never an authorization grant or proof that an external action ran.

Acceptance:

• Typed all, any and qualified threshold groups preserve incomplete membership, unknown and stale evidence, distinct voters and provider-qualified quorum semantics.
• Equipment ranges, exact references, supported exclusions and exhaustive alternatives remain distinct from scores and incomplete hypotheses. Conflicting sources cannot silently become a pass.
• Evidence binds exact resource incarnation, network scope, observation vantage, provenance and validity. Administrator or provider observations cannot substitute for a required client observation.
• Explain missing facts, unavailable authority, account-owner intervention and unsupported or unconfigured capabilities without disclosing protected dependencies or credentials.
• Technical-control and resource lifecycle prerequisites share this evaluator. Console access alone does not establish OS control; graceful actions never become forced actions implicitly. Hosting constraints and administrative inheritance remain independent.
• Return stable semantic requirement identities and permitted resolution inputs for later action and planning consumers, including predicted-state and concurrent-intent inputs. No new authorization engine, scheduler, provider effect or question store.
• Add the read-only API and useful desktop/phone interaction over real persistent inventory. Evaluation creates no snapshots, history, incidental writes or whole-estate graph hydration.

Validation: focused evaluator and disk-backed API tests, bounded/hostile input and restricted-field cases, generated-contract checks, and real desktop/mobile browser scenarios. Production authentication and live provider effects retain their separate qualification.