Keep uninstall atomic when host integration cleanup fails

[backnotprop]

Problem

The uninstaller should have one simple contract: remove Plannotator itself and its installed host integrations, while letting the user choose whether to retain or purge local Plannotator data.

The current --skip-hosts recovery path violates that contract. It can remove the binary while leaving hooks or plugins that still invoke it, creating a broken host configuration.

Required behavior

• Normal uninstall removes the binary, installer-owned assets, and detected Plannotator host integrations while retaining local data.
• Full purge performs the same removal and additionally deletes local Plannotator data after confirmation.
• If a host integration cannot be removed safely, stop before deleting the binary.
• Identify the blocking configuration and provide exact manual cleanup instructions, then let the user rerun uninstall.
• Do not report a successful uninstall that leaves active hooks pointing to a missing binary.
• Remove or retire --skip-hosts as a binary-removal bypass.

Tests

• A malformed or uneditable host configuration leaves the binary and integration intact and exits with actionable instructions.
• After manual cleanup, rerunning uninstall succeeds.
• Normal uninstall retains local data.
• Purge deletes local data.

Context

This supersedes the earlier proposal to preserve and merely report skipped host integrations. The product decision is that host integrations are part of the installation and must be removed with it.