feat(planning): add strict CompactionPlan protocol

[HayronHgh]

Scope

This PR implements M2 only as 0.2.0-dev.2. M2 and M3 are designed as one safety contract but remain separate implementations.

This PR contains no Runtime Validator, plan authorization, plan execution, context mutation, Transformer, Qwen Planner, artifact creation, or memory promotion.

What changed

Canonical inventory identity

• add deterministic inventory IDs and sha256: fingerprints
• fingerprint position/order, stable unit ID, content digest, kind, source, task, authority, lifecycle, protection, recoverability, recovery reference, dependencies, and token cost
• make unchanged repeated snapshots retain the same identity
• make any plan-relevant inventory change invalidate an old plan
• reserve manually registered Context Unit sequences before generating new IDs

Strict CompactionPlan protocol

• add src/compaction-plan.js
• exact schema version 1 with:
  • plan ID
  • bound inventory ID/fingerprint
  • stable unit decisions
  • KEEP, COMPRESS, EXTERNALIZE, EVICT, PROMOTE_PROPOSAL
  • critical/high/medium/low task-relative importance
  • bounded reason
  • positive targetTokens only for COMPRESS
• reject malformed JSON, unknown/missing fields, invalid IDs/actions/importance, duplicate decisions, stale inventories, unknown units, replacement text, Runtime-owned metadata, and authoritative token-savings claims
• define every unmentioned unit as implicit KEEP
• keep PROMOTE_PROPOSAL data-only with no target, content, authority, or persistence path

Model-free Planner seam

• add the asynchronous ContextPlanner contract
• add FakePlanner with cloned input/output and call capture
• do not import or call Qwen, llama.cpp, model clients, filesystem writes, or MemoryStore

Fixtures and documentation

• add a fixed four-unit inventory fixture
• add valid KEEP/COMPRESS/EXTERNALIZE/PROMOTE fixtures
• add invalid unknown-unit, duplicate, action, stale-inventory, extra-field, and negative-target fixtures
• add bilingual CompactionPlan protocol documentation
• extend bilingual RFC-001 with the implemented M2 boundary and detailed planned M3 authorization precedence, authority matrix, dependency closure, reason codes, token accounting, and no-execution gate

Safety boundary

CompactionPlan is a proposal type, not permission. validatePlanBinding() checks protocol identity and references only. It does not authorize any action.

The pipeline stops at:

Inventory -> FakePlanner -> strict parser -> binding check -> default expansion -> STOP

The frozen v0.1.2 src/context-manager.js, thresholds, durability gates, State Transfer, and config remain unchanged.

Validation

• npm.cmd test: 71 tests/subtests, 70 passed, 1 Windows file-symlink test skipped because the host denies file symlink creation
• all source files passed node --check
• 16 JSON files parsed
• 5 PowerShell files parsed
• 24 Markdown files passed relative-link validation
• sensitive-information scan clear
• M2 forbidden-dependency scan clear: no Qwen, llama client, file write, project memory, or MemoryStore path
• git diff --check clean
• real llama.cpp + Qwen3.6 runtime regression passed: ContextOS 0.2.0-dev.2 -> V020_M2_E2E_OK
• PR v0.2 foundation: benchmark lock and context inventory #3 was merged first; its merge commit 267a0038711accf508e128120f5264e8dacb94bb passed all main CI jobs and is this PR's base

Next milestone

0.2.0-dev.3 will implement M3 in a separate PR: Runtime Validator, protection/authority/recoverability precedence, transitive depends_on closure, cycle/missing-dependency failure, Runtime-derived potential reduction, machine-readable authorization results, audit-only promotion permission, and deterministic fallback. It will still stop before context execution.