Tighten setup executor ownership and learned setup plans

[shinpr]

Summary

• Delegate persisted setup plans to the setup executor instead of running them directly in the daemon, so failed setup can be diagnosed and repaired in the same executor context.
• Persist learned setup plans back to environment.yaml only after the setup executor returns a valid ready result with executable setup commands.
• Tighten setup-result validation across daemon, Claude guard, schema, and prompts so readiness checks cannot be saved as setup commands.
• Update Galley skill/profile guidance and plugin metadata for setup.commands[] and setup failure troubleshooting.

Closes #72

Verification

• go test ./...
• python3 -m py_compile internal/runner/claude_guard_plugin/scripts/require-final-json.py
• claude plugin validate plugins/galley
• claude plugin validate .claude-plugin/marketplace.json
• git diff --check