fix: make Composer runtime dependencies release-safe and prove scanner execution

[somethingwithproof]

Problem

MacTrack develop unconditionally requires plugins/mactrack/vendor/autoload.php from mactrack_resolver.php. A production tester on #342 installed the plugin without a generated vendor/ tree and hit a fatal error before the existing dependency diagnostic could run.

The repository correctly manages Net_DNS2 through Composer, but the source/archive installation contract does not guarantee that locked runtime dependencies have been installed.

Scope

• Centralize plugin dependency bootstrap with an actionable, non-fatal diagnostic.
• Keep dependencies Composer-managed; do not commit vendor/.
• Define and test a release/install path that runs composer install --no-dev.
• Exercise the installed plugin through Cacti’s actual poller/scanner entry points.
• Run against MariaDB and a real SNMP agent in Docker.
• Assert resolver, scanner registration, database writes, process exit codes, and logs.
• Require 100% line and branch coverage for new runtime/bootstrap code.

Acceptance criteria

• A missing vendor/autoload.php never produces an uncaught PHP fatal.
• A release artifact or documented source installation installs the exact locked runtime dependencies.
• Net_DNS2_Resolver loads in the installed plugin.
• The real MacTrack poller invokes a vendor scanner against the Docker SNMP fixture and persists expected observations.
• Failure paths—missing dependency, bad SNMP response, scanner failure, and database failure—are covered.
• Existing PHP 8.1–8.4 CI remains green.

Relationships

• Production report: fix(mactrack): correct xform_mac_address typo and resolver/VLAN logic bugs #342
• Architecture umbrella: PHP 8+ modernization (grouped) #304 and Adopt PHP 8.3 and enforceable PHP standards (umbrella) #315
• This is the prerequisite for Have Mactrack use Cacti sites instead #152 and the scanner/service-boundary work.