pub fn apply(plan: &Plan) -> RunReport
Run every step, skipping those already in effect.
A failing step is recorded and the rest still run: a resolver file that cannot be written should not stop the CA from being installed.