feat(governance): require approved plans for Builder

[alvaroloes]

What changes

Adds an opt-in builderPlanPolicy project control with optional and required modes.

When required is enabled, Builder accepts only one exact, unexpired Architect plan that:

• belongs to the same organization, project, repository and issue;
• was opened by a succeeded Architect run with a sealed Facility receipt;
• was approved by a distinct human principal;
• has not been rejected, expired, made stale or consumed already;
• binds the Architect workspace base SHA, receipt base SHA and a versioned digest of the issue scope.

The issue digest covers title, body, state, author, URL, normalized labels and material comments. Facility progress/publication comments and the exact /builder approval command are excluded because they are consequences of the plan; substantive text accompanying /builder remains material.

Freshness is checked against GitHub when the human approval is executed, again when the worker receives the queued run, and once more after the worker atomically claims it. The runner checkout is pinned to the approved base SHA, so a later branch-head change aborts before the model runs. A stale or unverifiable plan fails closed before credentials or sandbox creation and records the expected and observed hashes in the audit trail.

This revision composes the base-SHA provenance work from #166. Its original commit author is preserved in 8d6e40f.

It also makes Architect plan publication a durable, recoverable control-plane lane:

• Architect success and the canonical plan_acceptance proposal/open event commit atomically;
• a scheduled worker reconciles pending publication with durable exponential backoff and bounded cross-organization rotation;
• a stable GitHub marker recovers ambiguous responses without intentionally creating a second comment;
• legacy progress comments and deleted-comment 404 cases are handled without recreating a stale Gate;
• rejected, expired, approved or executed proposals remove the live approval CTA and close or suppress the publication ledger;
• publication failures cannot reopen a platform issue after a concurrent terminal outcome;
• expiry and executor state/event transitions share the same proposal-row serialization boundary.

Why

This is the fail-closed Human Gate 1 for #204. It prevents Builder from using a merely similar, machine-approved or outdated plan while keeping the approval, plan, repository revision, issue revision and final worker decision attributable.

No legacy proposal is promoted or backfilled. After this control plane is merged and deployed, a project enabling required must run Architect again and approve the newly generated proposal.

Verification

• Hosted CI is green on the current head
• Behaviour verified beyond the test suite
• Documentation updated

Exact governance implementation head fe208e235faa4d96ac0d70d591f5c291ae356257:

• pnpm test:critical — DB 18/18, CLI 98/98, API 543/543, gateway 57/57
• Builder plan integration — 30/30, including base drift, issue drift, approval-time outage, post-claim drift and post-claim outage
• GitHub platform lane — 62/62 on a clean database
• sandbox orchestrator — 37/37
• runner workspace and signed delivery — 80/80 in serial with required local socket access
• core — 34/34
• issue revision unit tests — 2/2
• full pnpm typecheck — 16/16 tasks; API typecheck repeated after the final delta
• pnpm lint — 416 files passed
• pnpm migrations:check — two compatible migrations checked (0042, 0043)
• git diff --check — passed

Current PR head 2e121bff320d8cf4e2aa2dfe7ab68f69649904ec adds only the final operational UI/documentation wording correction; Biome and git diff --check pass locally. Hosted run 32997376591 passed verify in 5m46s, self-host-build in 8m44s and sandbox-e2e in 11m42s. Conventional commit-subject and PR-title checks also passed.

The full local pnpm verify wrapper is not claimed because its external dependency-audit phase was not run locally. The hosted workflow owns that final check.

Activation boundary

• Keep the project policy optional until this PR is reviewed, merged and confirmed live on the internal Facility instance.
• After deployment, create a fresh Architect proposal; proposals created before the provenance envelope intentionally return builder_plan_freshness_unavailable.
• Human Gate 1 remains explicit. Facility never approves its own proposal and never merges the Builder PR.

GitHub cannot atomically lock an issue while Facility launches a sandbox. Facility therefore revalidates immediately after worker claim, executes only the immutable approved plan, and pins the repository checkout; a subsequent issue edit requires a new Architect run for any later approval.

Remote GitHub comment creation also remains technically at-least-once after an ambiguous response because the API provides no idempotency key. The stable marker, delayed backoff and reconciler bound and repair that residual window.

Refs #204
Incorporates #166

[alvaroloes]

Ready for maintainer review. The branch incorporates the unique base-SHA provenance commit from #166 as 8d6e40f, preserving Thanh Le Van as its original author, and composes it with the live issue/base freshness checks required for fail-closed Gate 1. Exact-head run 32997376591 is green: verify 5m46s, self-host-build 8m44s, and sandbox-e2e 11m42s.\n\n@jungle-lethanh, thank you for the provenance work — please flag any integration concern.

[alvaroloes]

@adrian-lorenzo, the Gate 1 foundation is ready for maintainer review. Exact head 2e121bf is green on verify, self-host-build, and sandbox-e2e; the PR is intentionally not being merged or promoted without your review.