Trim at a limb: defer, resume, reorder, close or re-plan a whole subtree in one action, with preview, receipt and undo #733

Pillar: P0 Trust (umbrella #586), with the alignment set. Waits for the milestone view (the issue this one is blocked by).

The owner, 2026-10-05: "There is a lot, which is great to see in one sense, that there is distant planning, but also bad because it's harder to make impactful decisions. I want to trim at a limb, not each leaf."

Outcome (what a person sees). On a milestone he takes one action on the whole limb: defer it, resume it, move it up or down against its siblings, close it as not doing, or hand it to the planner to re-plan as fewer, larger pieces. He sees every issue it will touch before it happens, gets a receipt, and can undo it.

Today. Deferring means linking each leaf behind the Later gate (#595) by hand. Closing means closing each leaf. There is no order between siblings that a person sets.

Acceptance.

• [ ] Limb actions on the milestone page, each ONE action over the whole subtree: defer (every open issue beneath it waits behind the Later gate, so the crew can pick none of it; this is how deferral works on the map today), resume (the reverse), raise and lower (its place against its siblings, which is the order the crew takes ready work in), close as not doing (with a reason, applied to the open leaves as dropped), and hand to the planner (to re-plan as fewer, larger pieces, with the limb named in its brief).
• [ ] Each action shows a preview that lists every issue it touches and what will change, before anything is written; then a receipt; then an undo that restores exactly what the receipt says.
• [ ] Reuse the fleet operations shape (#447, src/actions/fleet.ts, src/core/fleet_ops.ts): plan, apply, receipt, undo. Do not build a second one.
• [ ] The same actions through the API and an MCP tool, dry-run by default; only an rw token of a person who can write the repository may apply.
• [ ] Refusing tests first: a reader, a crew agent and an ro token cannot apply any limb action; a planner cannot close a person's issues through it.
• [ ] A limb flagged as a candidate to trim (the milestone view) offers defer and close as not doing first.

Contract (the owner's rule, docs/VISION.md).

• [ ] One interface per job. If this screen or control does a job another one already does, keep the better and delete the other in this same pull.
• [ ] Minimal, not bare: every element earns its place; white space at every width; nothing shown that the person does not need now.
• [ ] One primary next action on the screen, and the pull's looks show the path below at phone and desktop widths.
• [ ] The pull says what it removes for every screen or control it adds.

The path: the owner on a milestone that is a candidate to trim presses Defer; he reads the preview; he confirms; the receipt offers Undo.

Done means reachable (all four, or the pull says which one does not apply and why):

• Page: the actions on /:owner/:name/milestones/:number, with preview, receipt and undo
• MCP: a limb tool, dry-run by default
• Test: each action's preview equals what it then writes; undo restores it; the refusals above
• Look: the preview and the receipt, phone and desktop, on the pull

Start from: the milestone view's module, src/actions/fleet.ts, src/core/fleet_ops.ts, src/fleet/verbs.ts, src/actions/dependencies.ts, src/core/pillars.ts (the gate), docs/FLEET.md.

Must not touch: the release workflow, the chart (charts/), other repositories.