ControlPlane trait: plane-agnostic dual-mode commands (v0.1.63)

[sox8502]

What

Final phase of the control-plane separation (#88 was phases 1–2). Adds src/plane.rs:

• ControlPlane trait (#[async_trait(?Send)], 14 verbs derived mechanically from the six dual-mode commands' paired local/server arms)
• ServerPlane — wraps client.rs; a sync ServerPlaceholder runs pre-login guards first, then connect() fetches credentials exactly where the old server arms called require_credentials
• LocalPlane — owns the Store; ?Send because rusqlite is !Sync (planes are driven inline under block_on, never spawned — documented invariant)
• plane::Run domain type (+RunLog/RunOrigin) — merges the two run_failure_detail twins; output.rs no longer depends on client::Run

The six dual-mode commands (exp, runs, logs, project, report, create-experiment) are now thin: parse → resolve_*(id) → verb. Their bodies moved verbatim into the plane impls (commands shed ~2,000 lines).

Wire safety

Domain types are CLI-facing only. local::model (the up-API → UI wire), the SQLite schema, and the client.rs DTOs are untouched — none appear in the diff. Golden snapshots of all affected commands (local + server arms, incl. failure-detail rendering) captured on the pre-change build and re-diffed after: byte-identical.

src/plane lives outside src/local/ deliberately — local/mod.rs's invariant (nothing there calls client.rs) holds; local::resolve remains the pure decision layer. up.rs/supervise.rs stay off the trait as the cloud-mirror bridges; end-state layering verified by grep: commands → plane → {client | local+store}.

Verification

• cargo fmt --check / clippy -D warnings / cargo test --locked (193 passed; 6 new plane tests incl. all three RunOrigin failure wordings and the byte-exact LocalPlane unsupported message)
• End-to-end smoke on an isolated ORX_DATA_DIR + XDG_CONFIG_HOME: local arms logged-out, server arms stop at the login check, exp desc set/get/conflict paths, report guidance
• 4-agent review round (2 correctness incl. adversarial tracing of every launch branch/wait loop/telemetry firing point, 2 quality incl. an end-state architecture audit) — unanimous no-blockers; nits applied (exp desc stdin now resolves after the login check restoring pre-trait ordering; ServerPlane::report uses its own resolved id)