feat(s07): wire plan grounding into the plan park, advisory and default off

[im-tyler]

What

S07's first wiring: the plan-grounding check (PR #53, previously "no caller yet") now runs at the plan-park point, observe-only, behind the existing SHIP_PLAN_GROUNDING flag (default off).

• Where it fires: inside the existing plan-think step in nativeAdapter (src/durable.ts) — the step that immediately precedes the PLAN_EVENT park. With the flag on, the grounding report (files/symbols/commands the plan names, checked against the committed tree at the checkout's HEAD via read-only git queries) is computed there and attached as an additive grounding field on the step's recorded result. No new durable step, so the step sequence stays a function of the run input regardless of a worker's env, and a replay reads the report back from the log without re-running git (pinned by a replay test).
• What renders: the run page's plan-review card (web/src/routes/runs/[id].tsx) gains an advisory block — headline counts + revision, ungrounded refs first with reasons, revision-mismatch line when present — projected shape-checked by web/src/lib/plan-grounding-view.ts (the S09 finding-continuity-view pattern). No new routes.
• Honesty: the block carries the caveat mirrored from plan-grounding.ts: "grounded" only means the name exists in the committed tree at that revision — not that the plan is right. It never blocks and never edits the plan; the operator's approve/deny is the only authority.
• Degrade: a workspace that is not a git repository (bare run) omits the field entirely rather than reporting an empty all-ungrounded report.

Tests (mandatory discipline)

• Default-off equivalence: flag unset and explicitly off record byte-identical plan-think results, exactly the pre-wiring {text, usage} shape (src/plan-grounding-wiring.test.ts).
• Real-path, flag on: through durableAgent + executeRun + the actual PLAN_EVENT park, on a real git workspace read through a real LocalExecutor — grounded/ungrounded statuses and revision asserted; step sequence identical to a flag-off run of the same script; approve completes; replay re-runs no git and no model calls.
• Negative control: a fully ungrounded plan still parks (never blocks), lists every missing name with reasons, the plan text is untouched, and approve still completes.
• No-repo omission: flag on, bare workspace — no field, park unchanged.
• Web: plan-grounding-view.test.ts — absent field projects to undefined (page unchanged), ungrounded-first projection with counts/revision/caveat, revision mismatch surfaced, malformed input ignored, listing bounded.

Verification: pnpm run lint, pnpm run build, full node --test dist/**/*.test.js (2165 pass), scripts/swebench suites (143 pass, 1 pre-existing env skip; grader-sensitivity skipped locally per the standing rule — CI runs it), cd web && pnpm test (173 pass) and cd web && pnpm run build.

Status rows updated in docs/SHIP_RELEASE_PROGRAMME_2026-09-21.md (wave-4 table, S07) and AUDIT_OPEN.md.

Not done (deliberately): no durable step, no notify/webhook/inbox surfaces, nothing beyond the park point — the rest of S07 stays open.