Plans need a nod: with the setting on, POST …/plan stores one wave proposal and opens no issues #1621

Replaces half of #1114.

Done looks like

• [ ] A repository setting beside autonomy, plans need a nod, defaults to on for the owner's repositories.
• [ ] When it is on, POST /api/v1/repos/:o/:n/plan (and the MCP equivalent) validates the plan exactly as it does today, but stores it as one proposal instead of opening issues. A proposal has a title, a one-line why, its issues in order, and their blockedBy links. The answer says proposed and gives the proposal id.
• [ ] When it is off, nothing changes.
• [ ] Tests: the setting on stores a proposal and opens no issues. The setting off opens issues as today. An invalid plan is still refused with no_pillar. Each new test file is listed in GATE.

Files: the plan action, the repo settings, a named migration, test/.

Parked by the crew: the check failed ("the forge over MCP > plan opens linked issues all or none") and the decider saw no point in another try (pull #1743 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the preview's deploy failed and the decider saw no point in another try (pull #1749 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check failed ("the forge over MCP > plan opens linked issues all or none") and the decider saw no point in another try (pull #1743 closed)
2. the preview's deploy failed and the decider saw no point in another try (pull #1749 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Deferred behind the Later gate (#595). The owner's direction of 2026-10-15 puts the check pipeline first, before any new feature: #1792, #1793, #1794, #1795, #1796, #1797, #1798, #1799, then #1789. Red on the MCP plan test, then the preview deploy failed; plan-approval is new workflow and waits for the pipeline order.

replaced by #1813. Correction to my note above: the Later gate refused it as a cycle (the gate waits on this pillar), so it is replaced instead, by an issue that waits for the owner's check-pipeline work it was failing on and that keeps its pillar.