add per-migration status case (read-only drift check), integrate into sysmig status

status convention: print one line, exit 0 OK / 1 DRIFT / 2 unknown (e.g.
needs root). sysmig status now shows [applied ✓/✗/?] per migration and
exits 1 on drift. DB checks fall back to peer auth when non-root.

migrations/002-disable-networkd-dispatcher.sh

@@ -6,6 +6,15 @@ set -euo pipefail
 case "${1:-}" in
   up)   systemctl disable --now networkd-dispatcher.service
         echo "    networkd-dispatcher stopped and disabled" ;;
+  status)
+        en=$(systemctl is-enabled networkd-dispatcher.service 2>/dev/null || true)
+        ac=$(systemctl is-active networkd-dispatcher.service 2>/dev/null || true)
+        if [[ $en == disabled && $ac != active ]]; then
+          echo "OK networkd-dispatcher disabled, $ac"
+        else
+          echo "DRIFT networkd-dispatcher enabled=$en active=$ac (want disabled/inactive)"
+          exit 1
+        fi ;;
   down) systemctl enable --now networkd-dispatcher.service
         echo "    networkd-dispatcher re-enabled" ;;
 esac