feat: expose plan mode through public interfaces - #70

Summary

Makes native plan mode available through the supported coding-agent CLI and package interfaces while establishing an explicit interactive-only host boundary.
It also adds runtime-level coverage for accepted-plan routing, including ambiguous profile choices, stale continuation races, harness adoption failures, runtime replacement, and retry behavior.

Reasoning

The earlier plan lifecycle and routing work is not usable by embedders until its artifacts, continuation APIs, selection contracts, and route parser are exported from the public entry points.
At the same time, print, JSON, RPC, export, and authentication flows do not provide the interactive decision UI required to resolve a submitted or accepted plan, so they must reject that state before extensions, prompts, or session replacement can mutate anything.

Accepted-plan handoff crosses several asynchronous boundaries and may replace both the session wrapper and active runtime while retaining one underlying session manager.
Integration tests are needed to prove that the exact continuation remains authoritative through navigation, selection, activation, host rebind failure, disposal, and competing operations.

Changes

• Adds the built-in --plan flag, documents it as interactive-only, and applies the initial plan collaboration mode only when constructing the first interactive runtime.
• Rejects --plan for session export, print, JSON, RPC, and authentication commands before unsupported work begins, while leaving plain runtime metadata commands available.
• Registers /plan [on|off] as a built-in slash-command contract and updates CLI help to clarify how --no-tools, allowlists, denylists, inspection tools, and the intrinsic submit_plan tool interact.
• Adds shared non-interactive plan-state guards that detect active plan mode, a pending submitted plan, or a pending accepted-plan continuation and can validate a proposed session tree target before adoption.
• Checks persisted SessionManager state before non-interactive runtime and extension initialization, then checks the bound AgentSession again before non-interactive prompting.
• Exports plan artifacts, resolutions, collaboration modes, lifecycle entries, continuation options, profile-selection contracts, accepted-plan route decisions, router prompts, parsers, and routing functions from both public package entry points.
• Verifies that accepted routing receives the original goal and accepted artifact rather than the generated implementation wrapper, and that explicit stay, harness switching, pinned profiles, and newly selected profiles bind the expected runtime.
• Covers missing, cancelled, invalid, and successful ambiguous-profile resolutions while asserting stable proposal identity, safeguard summaries, tool-policy visibility, continuation retention, and disposal cancellation.
• Exercises session navigation during routing and selection, revalidation immediately before harness adoption, failed activation cleanup, adopted-descriptor retention after host rebind failure, and retry without duplicate routing.
• Extends CLI, auth, startup, slash-command, and runtime tests to assert rejection timing, preflight results, exclusive-operation races, and preservation of the accepted continuation on every recoverable failure.

Testing

• Validation ran on the final rebased stack: npm run check passed.
• Validation ran on the final rebased stack: the focused Vitest run across 28 affected files passed all 451 tests.
• This intermediate branch was reconstructed as part of the stack and was not checked independently after reconstruction.