Fleet: group per-host previews by what the operator would approve (a pure function) #678

#617's design rule "plan per distro class, approve per preview class" needs one piece that has no daemon dependency: given each host's preview, put the hosts whose previews are the same approval into one group, and show every split.

The input types exist: PreviewEnvelope (crates/sysknife-types/src/lib.rs:573) and the CLI's PreparedPreview { transaction_id, preview } (apps/sysknife-cli/src/client.rs:45). proposed_change carries {action, params} with params redacted, plus the autoremove set and deployment identity where they apply (crates/sysknife-daemon/src/dispatcher.rs:2436-2472).

Scope

• group_previews(&[(HostName, PreparedPreview)]) -> Result<Vec<PreviewGroup>, _> in the CLI crate. Two hosts share a group when their summary, risk_level, proposed_change, sorted expected_side_effects, sorted warnings, reboot_required and rollback_available are equal.
• Each group carries its member hosts and one representative preview. Empty input is an error, not an empty list (Fleet plan and execute: design and order of work #617: "fail closed on empty").
• No CLI command yet; fleet plan will call this once Planning against a remote daemon uses the client's distro, so a Fedora laptop loses the Ubuntu tools for an Ubuntu VM #618 and Show and pin the daemon's audit key, so a client knows which host is on the other end of the socket #619 land.

Traps

• Do not key on request_hash or transaction_id. Both differ per host by design, and fix(security): key request_hash with an HMAC under the audit key (chain_version 4) #627 (223e86e) made request_hash an HMAC under each host's own audit key, so keying on it would put every host in its own group.
• Do not key on current_state: it describes the host, not the change.
• proposed_change can differ legitimately (a different autoremove set on one host). That split is correct and must be shown, never merged away.

Tests first

• Two previews identical except request_hash and transaction_id form one group.
• Two previews with different autoremove sets form two groups.
• Reordered warnings still group together.
• Empty input is refused.
• Add request_hash to the key and the first test must go red.

Difficulty

medium: a pure function over existing types, but choosing the key is the whole job.

Getting started

CONTRIBUTING.md has the build and test commands. No CLA and no copyright waiver. The project is MIT; sign off each commit with git commit -s (the required dco check enforces it since #732).