fix: honor queue targets and scope plans to explicit state files

[eminos]

Summary

Queue surfaces can disagree when the configured strict-score target is below 100, and commands with an explicit nested state file can read or mutate another language's root plan.

 next / plan queue / queue footer
- implicit subjective threshold: 100
+ implicit threshold: resolved QueueContext target
 CLI --state <file>
- default plan: project/.desloppify/plan.json
+ default plan: <file>.parent/plan.json

Pass runtime config into the plan queue context, resolve execution/backlog thresholds consistently, and scope default plan persistence to the explicit state file for one command. Preserve explicit non-default threshold overrides and explicit plan paths. No persisted format migration.

Evidence

• Before: With target 85, a stale assessment at 94, a completed postflight scan and a queued mechanical finding, next selects the finding while plan/footer request the assessment. Four of six threshold regression cases fail.
  After: All six pass; next/plan/footer agree and leave their inputs unchanged. Exact fixture: tests/commands/test_queue_target_contract.py::test_next_plan_queue_and_footer_share_configured_target.
• Before: Given distinct root and nested plans, next --state .desloppify/typescript/state-typescript.json and plan --state .desloppify/typescript/state-typescript.json queue read the root plan; plan ... reset writes it. Three of four CLI regression cases fail.
  After: All four pass, including sibling backup preservation and context cleanup between CLI invocations. Exact fixture: tests/commands/test_explicit_state_plan_context.py.
• Actual next and plan queue against existing project state, with the same explicit state path, now agree on the nested plan's 20 unassessed dimensions and do not inherit the root plan's 17 ordered entries or 189 skips. Both language state files, both plans and config were verified byte-for-byte unchanged. Existing scan-data replay also confirms target-85 selection and footer agreement.
• Final patched PHP scan against the accepted project source and its immediate next both completed with exit 0, respecting the selected scope and exclusions. This verifies the actual workflow; it does not claim coverage from unavailable external detectors.
• The reviewed integration checkout passes 199 focused tests and Ruff. Its full python -B -m pytest desloppify/tests/ -q result is 5,854 passed, 70 failed, 4 skipped. The exact 70 failures also occur on its unmodified base: 55 explicit grammar-download DNS errors and 15 base-reproduced parser assertions. Full-suite success remains unverified in this environment.
• This PR contains only these two fixes on current upstream main; 197 focused tests and Ruff pass. Its full suite is 5,751 passed, 70 failed, 4 skipped. Re-running all 70 failed node IDs on this exact unmodified upstream base reproduces the identical set, including 55 download-DNS failures. The integration test count differs because that checkout includes a separate pending PR's tests. Full-suite success remains unverified here.

Merge Danger

Door: Two-way

No state migration. The plan-path override lasts for one CLI runtime invocation.

Blast Radius: Queue

Default execution/backlog assessment gating follows the resolved target. Commands with an explicit state file now default plan reads, writes and locks to its sibling plan.