fak guard drop-in gallery

Each card is resolved through the same drop-in planner as fak guard. The browser is a live read of provider autodetection, upstream wire, and child-only environment variables.

The terminal path is the same data path: go run ./cmd/dropindemo -selfcheck verifies every advertised entry point without a browser.