Implement proactive preflight planning

[pengfei-threemoonslab]

Summary

Implements Phase 3 proactive Shipgate planning without adding a second release verdict engine.

• Adds PreflightResultV2, PreflightPlanV1, and HostPermissionRequestV1, including deterministic signals[], verify routing, plan summaries, and optional host-grant drift.
• Adds agents-shipgate preflight --workspace . --plan <path|-> --json while preserving legacy preflight flags as compatibility shorthands.
• Moves host-grant inventory/diff logic into core.host_grants and keeps audit --host as a thin CLI wrapper.
• Extends preflight evaluators for protected surfaces, capability evidence gaps, least privilege, host permission requests, policy drift, and host-grant drift.
• Updates the read-only MCP shipgate.preflight tool to accept plan.
• Refreshes discovery docs, schemas, .well-known, agent instructions, skills, Cursor rules, and adoption harness criteria around the new plan-native proactive flow.

Validation

• ruff check .
• python scripts/generate_schemas.py --check
• pytest -q

Notes

report.json.release_decision.decision remains the only merge/release gate. Preflight remains a routing/projection surface and does not emit a competing pass/mergeable verdict.