Solve safe apply order across multiple terraform plans

Start by reading issue #43's speculative-apply machinery and identify how plans, simulated state, Policy checks, and reachability checks can be reused. Build a verification setup with two Terraform working directories, then confirm the solver returns the safe order with per-step state and reports the blocking invariant when no order exists.

TL;DR: Given plans from several terraform working directories, compute an apply order where no intermediate state breaks a Policy or reachability invariant — and output that order plus each step's simulated state.

User story

As an infrastructure engineer rolling out changes across several services, I want a safe apply order computed for me, so nothing gets stranded in a broken intermediate state mid-rollout.

Acceptance criteria

• Solver accepts plans from multiple terraform working directories as input
• For each candidate ordering, an intermediate simulated db is built per step (reusing #43's speculative-apply machinery)
• Each intermediate state is checked against the Policy rule registry and required reachability
• Solver outputs a valid apply order (working-directory sequence) where every intermediate state passes both checks
• Solver outputs the simulated state (or a summary) at each step of the returned order
• If no valid order exists, solver reports that plainly, naming which invariant blocks every candidate order
• Solver does not execute any apply itself — output only

How to verify

Set up two terraform working directories where applying directory A before B temporarily leaves a workload unreachable (invariant violation), but B-then-A doesn't. Run the solver against both plans. Confirm it returns the B-then-A order with per-step state, and confirms A-then-B would be rejected.

Out of scope

• Executing the solved order
• Single-plan (one working directory) ordering — that's resource-level and already implied within a normal terraform apply