Granular composable presets so one selection brings up a working platform, with per-slot override preserved

> 🤖 Generated by the Agentic Engineer

Part of #6875. Depends on the composition semantics decided in #6876.

## Problem

Maintainer direction 2026-09-04: capability slots are the substrate, **with granular presets on top**,
so it is quick to get one fully working platform running while still being configurable to one's
needs.

Slots alone do not deliver the headline promise of #6875. An adopter facing thirty individually
selectable capabilities has been handed the assembly problem in a tidier format — the choice paralysis
is the time cost. A preset is what turns "KSail can provision these capabilities" into "KSail gives you
a working platform."

The failure mode to avoid is equally clear: a preset that is a black box is just the fork-and-edit
problem again, because the first disagreement forces the adopter out of it entirely.

## What a preset must be

- **Composed of slots, never parallel to them.** A preset sets slot values; it introduces no capability
that is not expressible as slots. This keeps one mental model and one override path.
- **Granular** — per maintainer direction, presets are not one monolithic "production" switch. Expect
presets that cover a coherent slice (a security baseline, an observability baseline, a data
services baseline) and compose.
- **Partially overridable.** Adopting a preset and disagreeing with one slot must not mean abandoning
the preset. This is the property that decides whether presets are adopted or worked around.
- **Versioned and reviewable.** Changing what a preset means changes what adopters get on upgrade. That
change must be visible and reviewable, never silent.
- **Transparent.** An adopter can see exactly which slots a preset set, and to what.

## Acceptance criteria

- [ ] At least two composable presets exist, drawn from #6877's verdicts.
- [ ] Selecting a preset on a fresh cluster produces a working platform with no further configuration.
**Observed running, not inferred from a render.**
- [ ] A single slot can be overridden while keeping the rest of the preset.
- [ ] Presets compose without ambiguity, or composition is explicitly refused with a clear error —
silent precedence is not acceptable.
- [ ] `ksail` can report the effective slot values a preset resolves to, before provisioning.
- [ ] A preset version bump that changes resolved values surfaces the diff.
- [ ] Feature-flagged, default-off, tested in both states.

## Open question for #6876

Whether presets are data (shipped alongside the catalogue and versioned with it) or code. This changes
how a preset is reviewed and upgraded, and should be settled there rather than here.

## Size

Medium, once the slot substrate exists.

Start by reading the composition semantics in #6876 and the capability decisions in #6877, then inspect the existing slot and provisioning entry points once those issues establish them. Define completion against the acceptance criteria: composable, overridable and reviewable presets, effective-value reporting and diffs, observed fresh-cluster provisioning, and feature-flag tests in both states.

Written by the indexing model from the issue text.