Make state purge receipt-owned and server-aware #644

Problem

PR #642 made uninstall discover runtime state roots, but discovery is not ownership. A confirmed purge must not recursively remove an externally managed, shared, or uninstall-time-only AGENT_BUNDLE_STATE_ROOT.

This is a focused lifecycle/manifest-authority follow-up to #592.

Ownership model

• Record all runtime state locations per installed MCP server.
• Record the default derived <plugin>-<digest16> root as installation-owned by construction.
• Treat an explicit AGENT_BUNDLE_STATE_ROOT as owned only when installation created the previously absent directory and wrote an install-identity marker there.
• Treat pre-existing, shared, marker-less, or foreign-marker roots as retained and never recursively delete them.
• Resolve relative overrides using the server execution cwd, matching runtime resolvePluginRoot semantics.
• Purge only receipt-recorded owned roots whose marker/identity evidence still matches.

Acceptance

• Multiple server roots are represented and judged independently.
• Environment changes after install do not redirect purge.
• Shared bases and unrelated sentinels survive.
• Relative overrides and symlinked ancestors are safe.
• --keep-data followed by purge retains ownership evidence.
• Doctor reports runtime location, recorded location, and ownership/purgeability.
• Generated installer behavior matches the package CLI.
• English/Chinese CLI docs and diagnostics are updated.

Closes the lifecycle ownership gap found in the owner audit of #642.

Related: #592