feat: enforce host read-only planning capability

[AetherAI3]

Summary

• Add a typed planning capability to each host run and tool call. The host permits only read_file, list_directory, and repo_search, independently of skill policy or permission mode.
• Make /plan return a plan without saving it; add aether agent --planning for a one-shot task. Refuse server-executed cloud chat planning before a model request.
• Use the current workspace, refuse --repo, --worktree, and --resume, skip configured and final verification, and record the active capability in session metadata.
• Advertise the narrowed tools to Ollama and hosted dev sessions. Keep ordinary coding and explicit saved-phase execution paths intact.

Evidence

• npm run docs:check — passed.
• Planning/prompt/host/lifecycle fixtures — 74 passed.
• CLI/manifest/prompt-file fixtures — 29 passed.
• Protocol, coding verification, saved goal-phase, planning admission fixtures — 74 passed.
• Forged hosted dev-session write and local write calls were refused before executor invocation; --yes/skip policy did not bypass the planning gate.
• Cancelled planning admission left Git refs, index, tracked content, and configured test sentinel unchanged.

Closes #323

CI environment

• GitHub Actions jobs did not start. The runner annotation says: 'The job was not started because your account is locked due to a billing issue.' No repository test failure was reported by those jobs.