Require a human-approved plan before implementing an issue

[ableinc]

Summary

• Every labelled issue now gets a plan posted as a comment before any code is written; the daemon only implements once a human replies exactly implement on that comment. Any other reply is treated as feedback and triggers a revised plan.
• models.json gains a plan role alongside implement and triage, each with its own model ladder (internal/models/registry.go).
• New internal/orchestrator/phase.go reads an issue's comment history — tagging the harness's own comments with an invisible marker — to decide plan / wait / implement before anything is claimed.
• The plan run is read-only (claude.plan_permission_mode, default plan) and never commits, verifies, pushes, or opens a PR; it just saves the plan and comments it back.
• New agent-planned label and a plans table in SQLite track the latest pending/approved plan per issue.
• Retry ladder demotion now keys off failure count rather than attempt count, since a successful plan run no longer demotes the implement run that follows it.
• README updated to describe the new plan → approve → implement lifecycle and config fields.

Test plan

• go build ./...
• go vet ./...
• go test ./... (all packages pass, including new phase_test.go / prompt_test.go / store plan tests)
• go run ./cmd -config config.example.json -check — boot log shows both plan_ladder and implement_ladder
• Live end-to-end against a real labelled issue (plan comment appears → feedback triggers a revision → implement reply runs the change and opens the draft PR)

🤖 Generated with Claude Code