Stop saved plans from controlling ordinary repository work

[bigboateng]

Summary

• keep destructive and managed-state safety always on without treating saved or approved plans as workflow authority
• scope delivery supervision and publication controls to the active delivery on the current worktree branch
• carry explicit feature selection through status and generated host instructions across Cursor, Claude, Codex, and Gemini
• supervise generic MCP queries and live SQL only inside active managed scope

Verification

• go build ./...
• go vet ./...
• go test ./... -count=1 -timeout=15m
• python3 -m unittest discover -s .github/tests -p "test_*.py"
• python3 .github/scripts/release_notes.py validate --repo .