Unify execution with a serial typed job model

[yslib]

Summary

• model providers, packages, actions, and links as one ordered typed execution plan
• run apply through a strictly serial JobRunner, while --dry-run renders the same selected plan without executing it
• keep provider checks independent and preserve the existing CLI, schema, process, and link behavior

Why

The previous apply path stored and executed each phase separately. That duplicated orchestration facts, fragmented reporting, and made future exact job selection harder. This change establishes one internal source of truth without turning dot into a scheduler or package manager.

Impact

• full apply remains ordered as provider → package → action → link
• provider failures block only dependent packages; unrelated jobs continue
• duplicate link targets still block the complete link phase before mutation
• no new CLI syntax, concurrency, receipts, signal handling, or process supervision

Validation

• cargo fmt --all -- --check
• cargo clippy --locked --all-targets --all-features -- -D warnings
• cargo test --locked --all-targets --all-features
• cargo test --locked --release --test job_runner
• cargo test --locked --release --lib job_runner::tests