Don't mutate the caller's managed map in BuildPlans

BuildPlans passed the caller's managed map straight to addPruneCandidates, which inserts prune candidates — so a --prune plan mutated a map the caller still owns. BuildReplicationPlans already copied defensively. Copy inside the prune branch in both (the only mutation happens there), so neither touches the caller's map and the two functions stay symmetric.