feat(anolisa): add scoped status view

[ikunkun-sys]

Description

Expose scoped installed-state records in anolisa status so a user-mode
invocation can report components installed in the current user's state and
readable system-scope state without merging their physical write targets.

Status now loads through StateView with UserPlusSystem visibility. Each
visible root keeps its own FsLayout, so health and integrity probes evaluate
system records against system paths and user records against user paths.

Manifest catalogs are also loaded per visible root. System-scope records use
the system root catalog and overlays, while concrete system-root catalog loads
ignore user-controlled ANOLISA_DATA_DIR and executable-sibling discovery.

Status JSON and human output now include scope metadata for each record:

• scope
• active
• mutable_by_current_invocation
• shadowed_by
• state_path

This preserves mutation semantics: status only reports visibility. Receipts and
other writes still belong to the current install mode's physical state. Doctor
keeps using current-scope metadata and remains a follow-up PR for full scoped
view adoption.

Related Issue

N/A

Ship Note

anolisa status --install-mode user can now surface readable system-scope
install records alongside user-scope records. Output marks which record is
active, whether it is mutable by the current invocation, whether it is shadowed,
and which installed.toml file owns it.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Performance improvement
• CI/CD or build changes

Scope

• anolisa (anolisa-cli)
• anolisa-core

Testing

• cargo fmt --all -- --check
• cargo check
• cargo test -p anolisa-cli (429 tests)
• cargo clippy --workspace --all-targets --locked -- -D warnings
• cargo doc --no-deps
• cargo build -p anolisa-cli
• LSP diagnostics on changed Rust files
• git diff --check on the scoped status changes
• Local CLI QA with temporary user and system state:
  • user-mode JSON status for a shadowed component reports both records
  • human status includes scope, active, mutability, shadowing, and state path
  • conflicting user/system manifests use the system-root catalog for system
    records
  • malicious ANOLISA_DATA_DIR does not influence system-scope catalog
    selection
• Remote real-environment QA on Alinux 4:
  • root/system all-record status
  • unprivileged user/user all-record status
  • named system record visible from user mode
  • user-over-system shadowing
  • missing component behavior

[kongche-jbw]

发现一个 scoped catalog 问题，见行内评论。

[kongche-jbw]

lgtm