Execution plan grounded in current VPS reality: pre-flight checks, Track A (host auto-enroll via the agent) and Track B (phone auto-enroll), risks, and the honest one-bootstrap-tap constraint. R1 (CA material) verified present on VPS.
