[codex] Require planning promotion for epic candidates

[rickardvh]

Summary

• Add Planning candidate-pressure evidence to start/implement safety gates.
• Block broad or lane-shaped work when open roadmap/decomposition candidates need promotion first.
• Mark bare external issue refs as high-risk/unknown when no cached external intent evidence owns their scope.
• Keep truly bounded changed-path work possible while preventing broad epic closeout without planning proof.

Root cause

The routing surface exposed roadmap/decomposition candidates in secondary context, but next_safe_action and the planning safety gate still allowed broad work to continue without active lane ownership. Single issue refs were also treated as bounded from prompt shape alone when the issue body had not been consulted or cached.

Validation

• uv run pytest tests/test_workspace_start_preflight_cli.py tests/test_workspace_implement_cli.py -q
• make test-workspace
• make lint-workspace
• uv run python scripts/check/check_generated_command_packages.py

Closes #1215