feat(cli): validate prerequisites and seal installation plans

docs/install/standalone-manual-en.md

@@ -152,6 +152,46 @@ must already exist. Release assets, external connectivity, Catalog import and ru
 readiness remain explicit deferred checks. Success prepares the next preflight;
 it neither skips those checks nor establishes a completed installation.
 
+## Check prerequisites and produce the plan
+
+At step 3, before completing all application parameters, check the machine and
+the private installation directory already prepared:
+
+```bash
+tht installation preflight --directory /path/installation --json
+```
+
+This requires a reachable Linux Docker daemon, Compose 2.24 or newer, at least
+2 CPUs, 4 GiB allocated to Docker and 10 GiB free on the installation filesystem.
+A release may require more resources. On Windows run the Linux executable in
+Ubuntu WSL2 with Docker Desktop integration; Pi is bundled in the core image.
+
+At step 5, after `installation validate`, select the published release manifest
+with its downloaded bundle resources and produce a new plan:
+
+```bash
+tht --installation /path/installation/thothii-installation.yaml installation plan \
+  --workspaces /path/workspaces \
+  --release /path/release/release-manifest.json \
+  --output /path/installation/installation-plan.json --json
+```
+
+This repeats document checks, verifies image digests and Compose, Git, available
+external databases and Evidence, then saves the plan and its separate private
+`.key` file. It does not execute setup. Missing images and unavailable existing
+dependencies block the plan. Actual Docker Hub publication remains the next ticket;
+an invented manifest cannot bypass publication.
+
+Correct `error` outcomes and read `warning` outcomes. `deferred-to-runtime` entries
+are mandatory checks after startup, not readiness already achieved. After changing
+documents or rotating credentials, produce a new plan; existing files are never
+overwritten. Keep both plan files outside workspace Git. External probes perform
+bounded database authentication/schema reads, Git/HTTP/S3 reads and explicit model
+endpoint reachability checks. They invoke no LLM generation; HTTP/S3 requests may
+incur ordinary service request charges. See the
+[preflight reference](installation-preflight.md) for limits, the manifest
+format and runtime obligations.
+
 ## Before you start: the two repositories
 
 There are two separate repositories: