feat(plane): add secure dispatch and multi-role decision workflow

[lefarcen]

Summary

• Add a self-service Plane connection flow for one owner-bound local Looper node.
• Consume signed, session-fenced Plane dispatches and report queued, running, failed, waiting, review, and completion state back to Plane.
• Route product, design, engineering, and QA questions to their owners; evaluate natural-language replies with the model, follow up when incomplete, and resume automatically after convergence.
• Keep formal product specs as an explicit Plane document gate while making Feishu notification-only.

This is a stacked PR on #526. Its Plane server/UI counterpart is makeplane/plane#9459.

Testing

• go test ./...
• Additional targeted checks:
  • go test ./internal/planestrict ./internal/planner/... ./internal/runtime -count=1
  • strict signed request/reply client contract tests
  • model verdict parsing, exact question coverage, delegation, and formal product-spec guard tests
  • isolated Plane browser flow and cross-repository signed contract flow

A full go test ./... run completed except for one pre-existing timing-sensitive TestExecutorRefusedFallbackRebindSurfacesKilled failure; its immediate isolated rerun passed.

E2E / Invariant Risk

• No Looper E2E / invariant risk
• Daemon boot / config / runtime path risk
• Worktree / repo isolation / lifecycle risk
• GitHub CLI contract / auth / scope risk
• Resolve-comments / PR thread mutation risk
• Real sandbox GitHub behavior risk

Regression Policy

• This is not a P0/P1 bug fix
• This is a P0/P1 bug fix and includes a regression test that fails before the fix
• Cross-component lifecycle / worktree / GitHub command / daemon / resolve-comments regression is covered by a contract/invariant integration scenario
• Real GitHub auth / scope / thread mutation / rate-limit regression is covered by sandbox E2E

Regression Mapping

• PR / issue links for regression coverage:
  • Plane integration and UI: feat(looper): add native collaboration control and multi-turn decisions makeplane/plane#9459
  • Parent lifecycle refactor: feat: lifecycle-driven Looper with native Plane collaboration #526
  • Plane work item: OPEND-1645

Reviewer Checklist

• Tests validate user-visible invariants, not only implementation details
• P0/P1 regression policy requirements above are satisfied