Make guest and HP provisioning lazy and backend-specific

[vincentcr]

Goal
Provision only the guest capabilities required by the selected backend, and never install HP software for WSD jobs.

Scope

• Separate core guest packages and sane-airscan support from HPLIP-specific packages.
• Install and validate the proprietary HP plugin only when hpaio needs it.
• Track provisioning capabilities rather than one global provisioned flag.
• Preserve idempotent upgrades for existing VMs.
• Keep host-side discovery VM-free; start the guest only after routing selects WSD or legacy acquisition.

Acceptance criteria

• Scanner discovery does not create or start the VM.
• WSD scanning provisions sane-airscan without installing or initializing HPLIP.
• Legacy HP scanning provisions everything it needs.
• An existing provisioned VM remains usable.
• Provisioning failures identify the missing backend component.

Dependency
Requires #4 backend routing and #9 encapsulated HP backend.