add per-migration status case (read-only drift check), integrate into sysmig status

status convention: print one line, exit 0 OK / 1 DRIFT / 2 unknown (e.g.
needs root). sysmig status now shows [applied ✓/✗/?] per migration and
exits 1 on drift. DB checks fall back to peer auth when non-root.

migrations/004-purge-haveged.sh

@@ -10,6 +10,12 @@ case "${1:-}" in
         apt-get purge -y haveged >/dev/null
         apt-get autoremove --purge -y >/dev/null
         echo "    haveged stopped + package purged" ;;
+  status)
+        if dpkg-query -W -f='${db:Status-Abbrev}' haveged 2>/dev/null | grep -q '^ii'; then
+          echo "DRIFT haveged is installed"
+          exit 1
+        fi
+        echo "OK haveged not installed" ;;
   down) apt-get update -qq
         apt-get install -y haveged >/dev/null
         systemctl enable --now haveged.service