The planner can close an issue as split, replaced or dropped, as its brief tells it to, and nothing else #2503

Why: the planner's brief tells it to close a re-planned issue with PATCH …/issues/N {"state":"closed","reason":"split"|"dropped","into":[…]}. Its token gets 403 "your credentials lack the scope for this action" (src/http/respond.ts). Every re-plan therefore leaves the old issue open, and it comes back. Either the token or the brief is wrong. This makes them agree.

Done looks like:

• [ ] A crew member whose role is planner, acting on its own repository, may PATCH an issue to closed with reason split (with into naming issues opened since it was handed the issue, as src/actions/issues.ts already checks), dropped (only an issue the crew wrote), or done (only when alreadyDone() names commits for it). Any other close, any reopen, and any edit to a person's issue stay 403.
• [ ] Tests cover each case: the planner splits, drops a crew issue, and closes a done-on-main issue. It is refused when dropping a person's issue, when splitting into an issue older than the hand-over, and when closing as done with no done note.
• [ ] README's crew section says what the planner may close.

Files: src/actions/issues.ts, src/http/api.ts (the scope check on the issue PATCH), tests, README.md. Risk: this widens an agent token. Keep the check in actions, not the route, so the web and the MCP enforce it the same way.