Follow-ups from the perf-debugging session that established the
collections+role-meta routing requirement.

Routing / docs
- Update the README's speedup claim. Real measured on a converged plex
  deploy: ~15-25% (57-69s -> 48s) with all overrides firing and
  pipelining on. The earlier 37s number was an incomplete run (a
  command-action bug killed it ~70% through). Honest framing: speedup
  grows with task count, network latency, and number of changed tasks;
  on a fast LAN with mostly-ok tasks it is bounded by ~15s of ansible
  Python overhead between RPCs.

Robustness
- `_try_local_socket` connects to the local SSH-forwarded socket without
  probing the remote daemon. If the daemon idle-timed out (1h default)
  the local socket file still exists, connect succeeds, and the first
  RPC fails with EPIPE mid-deploy. Fix: send a Hello probe after
  connect, and if it fails, tear down the forwarding and re-bootstrap.
  Reproduced twice in this session — once from network drop, once from
  daemon idle timeout.

Agent
- `handleExec` uses `strings.Fields(p.CmdString)` to split commands when
  argv is not provided. This breaks any quoted argument (e.g. `su - u
  -c 'cmd with spaces'`). Action plugin now compensates by always
  sending shlex-parsed argv, but the agent still has the footgun. Fix:
  use a real shell-style splitter, or reject cmd_string with quotes
  when use_shell=False.

Action plugin discipline
- Keep every fallback path on `ansible.builtin.*`; this is now documented in
  docs/compatibility.md and guarded by tests/test_action_plugin_fallbacks.py.

Coverage
- Add action overrides for the highest-frequency non-overridden modules.
  In the plex deploy these were template (~7), lineinfile (~3), sysctl
  (~2). Each call still goes through ansible's pipelined python path.
- Verify systemd override actually fires. Trace from the 37s run
  showed 0 Service RPCs despite systemd tasks being present — the
  module shim exists and the action plugin is wired up, so something
  else is preventing it.
