Plan lifecycle: edit owns no step status once work starts

[DocksDocks]

Closes #42

Implements the reviewed plan #42:

• Execution-state freeze - plan.mjs edit refuses any Steps Status-cell change, row removal, display-number change, Depends rewrite, or Effect rewrite once the plan is past planned; started is irreversible (current status OR a plan:ongoing labeled event in issue history). Task, Files, and Done when stay editable as prose.
• Append-only new rows - on a started open plan a new row must carry planned and append after existing rows; closed plans refuse new rows entirely (terminal repair via plan.mjs step stays the only post-merge route).
• Pre-start freedom pinned - Steps tables stay freely redraftable while drafting/planned, including with blocked-only label history: pre-start parking is not started work.
• Tests - gh stub gains the issue-events endpoint; plan-cli covers every refusal (exit 1, unchanged body, no body-write call, unchanged provenance) plus the acceptance paths; phase-sync suite pins the clause across contract, SKILL table, docs/PLAN.md, and template.

Reviews: plan review rounds 1-3 repair -> round 4 pass (advisory-amended bytes); code review round 1 pass (no findings).
Verification: full node scripts/ci.mjs exit 0; plan-cli, plan-skill-phases, plugin selftest all exit 0.