Add plants:align_visibility for the ECHOcommunity plant migration

[npflood]

Phase 1 of the plant-data ownership migration, and the companion to #117.

Aligns Plant API visibility with ECHOcommunity's editorial state. ECHOcommunity
decides whether a plant is published, and its deletions made after the 2020
export are authoritative — several plants it removed years ago are still public
in the API today.

bin/rails plants:align_visibility[tmp/status.json]              # dry run
APPLY=true bin/rails plants:align_visibility[tmp/status.json]   # write

The status file is produced by the migration workspace, so this application
never holds a connection to ECHOcommunity's database.

Behaviour worth reviewing

• Only plants owned by ECHO_ORG_ID are considered, and only those whose
  visibility actually differs are written.
• A plant absent from the status file is left alone. That covers the 107
  contributed plants and the three species created by the 2026-08-07 Acacia
  split — records that legitimately exist only in the API. Silence in the file
  is not evidence of deletion, and there is a spec pinning that.
• Mapping is published → public, draft → draft, deleted → deleted, applied
  through update! so the visibility trio and PaperTrail behave normally.

Rehearsed against staging

After #117's import ran, this task changed 73 records — 67 ECHOcommunity
drafts to draft and 6 deletions to deleted — with 319 already correct and no
failures. The migration's cutover guard then reported:

  ECHOcommunity published          319
  Plant API ECHO-public            319
  in both                          319
  would VANISH from the site         0
  would APPEAR from the site         0
  PASS

That is the Phase 1 exit criterion met in the rehearsal environment: a cutover
would change nothing publicly.

• 7 new specs
• Full suite: 2,319 examples, 0 failures
• Rubocop clean

Independent of #116 and #117; can merge in any order.