feat(run-once): integrate planning phases and require implementation pull requests

[rochecompaan]

Summary

• route fresh and active run-once work through the locked planning-pr-v1 phase coordinator while preserving unfinished legacy recovery
• support all spec/plan review gate combinations plus explicit review-pending and plan-only stop results
• force implementation pull requests and independently validate repository, base, head, status, marker, closing reference, remote head, and commit ancestry
• persist strict implementation and finish checkpoints before handoff, cleanup, branch removal, or lifecycle labels
• extract focused agent, phase, runtime, validation, and finish modules with recording and compatibility coverage
• retain compatibility with the current TypeScript crypto hash input contract after rebasing onto current main

Validation

• focused issue Integrate planning phases and require implementation pull requests #189 suites: 81/81 passed
• npm run test:run-once: 651/651 passed
• npm test: 1747/1747 passed
• npm run build: passed
• npm run lint: passed
• npm run check:types: passed
• npm run check:architecture: passed (456 modules, 1929 dependencies, no violations)
• git diff --check: passed
• dependency metadata unchanged; conditional Nix build skipped per repository policy

Reviews

• Final Codex full-worktree review: passed after all correctness and safety findings were fixed
• Final thermo-nuclear review: passed after checkpoint, module-boundary, and canonical-helper fixes
• Final validation-readiness review: passed on rebased exact HEAD with no findings

Human review is required because this is a large, security-sensitive workflow/state-machine change with new public result discriminants and destructive cleanup boundaries.

Closes #189