replace prediction with semantic intent

[atkrad]

Summary

• Build the semantic plan from Previous, Live, and Desired intent. Cluster reads are GET and mapping only. Helm action comes from raw chart intent, not live drift.
• Plan extras CRDs and the install target Namespace as intent. Skip OriginNamespace when the chart already has that Namespace. Keep a plan when an upgrade is missing its Namespace.
• Show modified and missing drift on the semantic plan. Rewrite deployah plan --drift as GET plus Desired declared-surface projection minus spec-edit paths.

Default deployah plan and deployah deploy stay on the legacy planner.

Test plan

• Unit tests added/updated
• Scenario under scenarios/ (if behavior changes)
• nix run .#lint / pre-commit clean
• Manual smoke (command + expected result), if user-facing

Kind e2e TestE2E/TestSemanticPlanPrerequisites covers the non-mutating GET path.

Labels

• One of: kind/feature, kind/bug, kind/docs, kind/chore
• Add breaking-change if this breaks existing CLI or config behavior
• Add skip-changelog for internal-only PRs that should not appear in notes

Checklist

• Title is short and imperative (matches commit style)
• Docs / CLI help updated when user-facing (README.md, docs/cli/)
• No secrets or local-only paths in the diff

[codecov]

Codecov Report

❌ Patch coverage is 88.34437% with 88 lines in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
internal/plan/semantic/project.go	81.75%	25 Missing ⚠️
internal/plan/helm_intent.go	92.55%	14 Missing ⚠️
internal/plan/objects.go	85.36%	12 Missing ⚠️
internal/plan/view/human.go	75.67%	9 Missing ⚠️
internal/drift/drift.go	75.86%	7 Missing ⚠️
internal/plan/namespace.go	87.87%	4 Missing ⚠️
internal/plan/semantic_build.go	91.30%	4 Missing ⚠️
internal/plan/cluster.go	90.32%	3 Missing ⚠️
internal/cmd/plan/plan.go	0.00%	2 Missing ⚠️
internal/plan/apply_semantics.go	94.11%	2 Missing ⚠️
... and 4 more

📢 Thoughts on this report? Let us know!