feat(plan): add polyphony plan write-plan verb (Phase 3 P7b foundation)

[PolyphonyRequiem]

Phase 3 — P7b foundation #1 of N

Pure file-IO verb that writes the architect's plan markdown to plans/plan-{item_id}.md. Stacks on PR #82 (P7a). Workflow rewrite (the original plan-level.yaml rewrite) is now split into multiple PRs per the rubber-duck critique below.

Scope (intentionally tight)

• New verb: polyphony plan write-plan --item-id N --content-json '<json-encoded markdown>' [--plans-dir plans]
• New result type PlanWritePlanResult (item_id, path, bytes_written, content_sha256, unchanged, error)
• 11 new unit tests covering: input validation (3 error envelopes), happy path, sha256, idempotent rewrite, overwrite, nested-dir creation, empty content, Unicode round-trip
• content_sha256 is included so the workflow can verify end-to-end integrity from architect output → committed PR artifact (one of the rubber-duck recommendations)

Why this verb (and not inline pwsh)

Rubber-duck pass on the broader P7b design (saved as files/p7b-rubber-duck-critique.md) flagged inline Set-Content of multi-line markdown as fragile (quoting, encoding, no integrity check). A small verb is testable, AOT-friendly, and gives us the SHA-256 hook for free.

What's NOT in this PR

The original P7 design (plan-level.yaml rewrite) is being split per the duck's recommendation:

• P7b-i — deterministic plan-PR substrate (this PR + 3-4 follow-ups: plan commit-and-push, plan detect-state, fix to pr open-plan-pr to read manifest from origin/feature/{root}, then the actual workflow rewrite without LLM reviewer)
• P7b-ii — advisory plan_reviewer agent (LLM posts comments only, per P7-pre identity decision)
• P7b-iii — policy-controlled auto-merge (polyphony policy resolve gate before merge-plan-pr)

10 blocking issues from the rubber-duck pass are tracked in the critique file for the next planning round.

Testing

• 1783/1783 tests passing locally (was 1772; +11)
• Type-agnostic lint clean (all 4 surfaces)
• AOT-friendly (PolyphonyJsonContext registered)

Branch name nit

Branch is named sdlc/plan-level-rewrite but this PR does not yet rewrite plan-level.yaml — that's the eventual P7b consumer flip after all the foundational verbs land. Branch will be reused for follow-up commits as the substrate stack grows; squash-merge here keeps one commit per PR per usual.