chore(planning): enforce published deferred-validation catalogs

[codex-scheduled-tasks]

Closes #63. Full fleet rollout D-sorganization/Repository_Management#1687 remains open.

The two published deferred scopes now have the exact canonical validator bundle, SHA-256 receipt and always-run local hook. Five consumer tests exercise the configured command, verify the installed bundle, and reject premature activation, missing checker and competing catalogs. Both original plans/source snapshots and the private-data lock remain byte-identical. The approved managed instruction block was already present on current main and is preserved.

Developer dependencies add pre-commit, PyYAML and its typing stubs. No client/model behavior, private-data access, source rights or consent changes.

Validation:

• Five RED missing-hook/receipt failures, then all 54 tests pass.
• Actual pre-commit hook, root Ruff lint and format (20 files), and strict typing of the new test pass.
• Full local mypy reproduces the documented unused-ignore finding in unchanged corpus.py:193 (17 files checked); no ignore or gate was relaxed. Hosted Python 3.12 qualification remains required.
• Original source/planning/lock hashes and all three canonical bundle hashes verified; development log passes.
• Existing CRLF is preserved in README/development log; whitespace check recognizes CR-at-EOL rather than normalizing unrelated lines.

The canonical handoff documents exact continuation state and limits. Numerical/software checks do not supply measurements or permission. Issues #8/#18 retain their independently executable work; rights-holder contact is not part of this change.