add per-migration status case (read-only drift check), integrate into sysmig status

status convention: print one line, exit 0 OK / 1 DRIFT / 2 unknown (e.g.
needs root). sysmig status now shows [applied ✓/✗/?] per migration and
exits 1 on drift. DB checks fall back to peer auth when non-root.

migrations/003-purge-exim4.sh

@@ -11,6 +11,12 @@ case "${1:-}" in
         apt-get purge -y exim4-daemon-light >/dev/null
         apt-get autoremove --purge -y >/dev/null
         echo "    exim4 stopped + package purged + deps cleaned" ;;
+  status)
+        if dpkg-query -W -f='${db:Status-Abbrev}' exim4-daemon-light 2>/dev/null | grep -q '^ii'; then
+          echo "DRIFT exim4-daemon-light is installed"
+          exit 1
+        fi
+        echo "OK exim4-daemon-light not installed" ;;
   down) apt-get update -qq
         apt-get install -y exim4-daemon-light >/dev/null
         systemctl enable --now exim4.service