Function plan_next 

pub fn plan_next(
    manifests: &SignedManifestSet,
    fleet_state: &FleetState,
    quarantines: &QuarantineSet,
    now: DateTime<Utc>,
) -> Vec<PlanAction>

Pure reducer: given the trust-verified manifests, the current per-host state aggregate, and the active quarantine table, produce a list of PlanActions for the applier to execute.

Determinism: (manifests, fleet_state, quarantines, now) → Vec<PlanAction>. No hidden state, no I/O. Same inputs → same output.