When the LPR OCR misreads a plate it auto-creates a ghost vehicle and hangs its
passages off it. This orchestrates the correction in prod: moves the passages to
the real vehicle, renames the image files on the host (their name is derived from
the plate), and deletes the ghost. Dry-run by default; --apply to execute.
Validates both vehicles exist, warns if the "wrong" plate isn't actually a ghost,
and aborts on filename collisions.