fix: simplify dashboard and disable unauthorized actions

internal/target/target.go

@@ -78,6 +78,12 @@ type Diagnosable interface {
 	DiagnosticChecks(context.Context, *profile.Profile) []Check
 }
 
+// MutationAuthorizer optionally explains why a detected Target cannot be
+// changed by the current process. It is read-only and presentation-independent.
+type MutationAuthorizer interface {
+	MutationAuthority(context.Context) Check
+}
+
 // Target hides platform paths and commands from the application and TUI.
 type Target interface {
 	ID() string