feat: add governed Developer OS planning loop v1

[Mopati123]

Purpose

Begin Phase N by composing certified Repository Intelligence outputs into a deterministic governed Developer OS plan.

v1 loop

change request
  -> repository graph
  -> change impact
  -> repo.read scope
  -> baseline test scope
  -> repo.patch scope
  -> retest scope
  -> repository intelligence recompute
  -> evidence finalization

Authority boundary

The generated developer plan is proposal-only:

• authority_semantics=proposal_plan_only
• execution_authorized=false

The patch stage explicitly requires HPL execution authority.

Reconciliation requirements

A developer run cannot reconcile unless:

• every stage emits a receipt;
• every stage succeeds;
• the patch stage proves an execution token was present;
• retest occurs after patch;
• repository intelligence is recomputed;
• evidence finalization occurs.

Truth boundary

This PR defines the deterministic orchestration contract. It does not yet perform live cross-repo calls into OpenHands or the HPL kernel.

Review order

This PR is stacked on certified Repository Intelligence v3 and remains draft until CI passes.

Certified Phase N v1 baseline

At head c54537b03237d0e0c029b975e9f21ec8d1c12282, the dedicated Repository Intelligence CI completed successfully.

Certified v1 Developer OS surface:

• deterministic proposal-only developer plan;
• bounded repo.read, test.execute, and repo.patch scopes;
• explicit HPL authority requirement for patch;
• mandatory retest after patch;
• mandatory repository-intelligence recomputation;
• mandatory evidence finalization;
• deterministic run reconciliation contract.

Truth boundary: v1 defines and proves the orchestration contract only. It does not yet perform live cross-repository calls into OpenHands or the HPL kernel.

This commit is the certified Phase N v1 baseline. PR remains draft and unmerged.