feat: add isolated provider-pinned /deep-plan workflow

[Sam Schillace (ramparte)]

Summary

Add /deep-plan <task> as an explicit premium planning workflow without mutating the parent conversation's provider selection, hooks, or normal execution routing.

• create a short-lived child planning session with no tools or agents/delegation
• default to the exact child target anthropic / claude-fable-5 / effort=max
• specialize only the child before initialization with one ProviderPreference; the parent's mounted provider and normal model remain unchanged
• exclude both hooks-routing and hooks-matrix-guard from the exact direct planning child, making that one planner call independent of the parent's routing matrix
• leave the parent's hooks and matrix untouched; subsequent parent execution is normal, and any delegation still requires a matrix compatible with the delegated provider/model roles
• disable Anthropic refusal and overload fallback for Fable so an unavailable request fails instead of silently selecting another model
• preserve provider-only configuration for a deliberately mounted named instance such as fable, deriving and validating that mount's exact default model
• validate the mounted provider ID, vendor, exact model, and effective provider configuration before execution, preserving the same-vendor boundary and failing closed on any mismatch
• require the child's observed pinned provider:resolve event to prove the exact provider and model after execution, then display that validated attribution
• expand task @mentions once so planning and execution share the same snapshot
• carry cancellation across planning and the parent handoff, while bridging child cost exactly once on success, failure, or cancellation
• treat the returned plan as untrusted advisory context, then perform exactly one normal parent-session execution with unchanged routing, tools, permissions, and approvals

Configuration

The implicit and recommended default is:

deep_plan:
provider: anthropicmodel: claude-fable-5effort: max

A dedicated mounted provider remains supported when its default model is already the intended exact planner model:

deep_plan:
provider: fable

Provider IDs must name live mounted instances. Exact-model mode rejects globs, specializes only the child mount, and validates the resulting provider configuration before any planning request.

Matrix isolation

The direct planning child intentionally omits hooks-routing and hooks-matrix-guard. This lets the configured mounted Anthropic provider run the exact Fable model even when the parent session's active routing matrix is, for example, OpenAI. The omission is child-local: the parent keeps its original hooks and matrix for the normal execution turn. If that parent turn delegates work, its matrix must still provide compatible routes for those delegated roles.

Testing

• actual local no-call reproduction with parent matrix openai plus mounted anthropic provider: PASS
• focused tests: 74 passed
• full suite: 1450 passed, 1 skipped, 1 xfailed
• Ruff format and lint: PASS
• Pyright: 0 errors
• compile checks: PASS
• Git diff checks: PASS
• independent architecture review: PASS

Validation used the healthy installed Foundation package because the unrelated sibling Foundation source checkout contains pre-existing conflict markers. This kept validation isolated from that checkout and does not indicate a feature failure.