feat(boatstack): actor-typed next steps — turns end only at the operator frontier

[bigboateng]

Problem

The response contract renders one ### Next step, but nothing types who performs it. When the step is the coding agent's own work ("amend and reactivate the plan, then implement and run the test"), the turn still ends — so the operator gets handed the agent's to-do list and has to re-prompt ("ok is it done?", "what's next") just to return control. The operator frontier already exists implicitly in the run coordinator (pause for a, a material product answer, o/u), but next mode and the contract don't carry it.

Control law: turn-ends-only-at-the-operator-frontier

Every prescribed next step is typed by actor:

• Operator-owned — exactly the steps owing operator knowledge or authority: approval (a), publish (o/u), cleanup (c/k), a feature choice, a source-plan path, correction facts (--message/--source-stage/--classification), --mutation, --preview-fingerprint.
• Agent-owned — everything else, including steps whose owed inputs are evidence the agent produces by doing the work (--status --evidence, the review protocol). Owing evidence never crosses the frontier.
• None — terminal states.

A working response may end only at the operator frontier. The read-only next status query is the one exception (a status question must not mutate): an agent-owned step renders as a one-key delegation — "This step is mine to do. Reply g and I will do it now, then continue to your next decision." — so the operator's next action is always a single key, even when the work is the agent's. Liveness guard: a prescription repeated without progress is a stall and hands the turn to the operator. Fail-closed: anything unclassifiable is operator-owned, i.e. today's prescribe-and-stop.

Changes

• flow_control.go: NextActor type, operatorOwedFlags (knowledge/authority vs work-derivable evidence), classifyNextActor, FlowNext.Actor (next_actor in flow next --json), actor line in FormatFlowNext.
• next_response.go: agent-owned prescribed steps carry the delegation marker + g reply.
• references/workflow.md: new The operator frontier subsection in the response contract; next table row names the g delegation.
• export.go: the boatstack-next instruction carries the frontier rule (delegation reply, continue-until-operator loop, no-progress stall guard) while staying strictly read-only per invocation.
• next_actor_conformance_test.go: per-stage classification through real resolution, fail-closed boundary cases, render-marker parity, exported-instruction bypass guarantee.
• Release note + test_product_loop.py export assertions.

Verification

• go test ./... green (full lab suite, 110s).
• python -m unittest discover -s tests green (23 tests).
• release_notes.py preflight PASS.