Centralize planning bootstrap command authority

[bigboateng]

Summary

This change removes split authority for constructing the first managed planning command.

Before a feature candidate exists, lifecycle status cannot authorize creation. Generated instructions therefore had to construct planning-write themselves, which allowed embedded and detached workspace behavior to diverge. On PowerShell, the same path also failed to preserve the full native-process result: piped Markdown could gain a BOM or CRLF line endings, and a rejected helper could still appear successful because $LASTEXITCODE was not propagated.

flow bootstrap is now the canonical read-only boundary for this transition. It validates explicit creation intent and returns one prescription bound to the current worktree, runtime helper, source-plan path and digest, feature, artifact, and shell. Generated guidance uses that prescription and resolves it again from the destination returned by workspace-cut.

PowerShell transport is normalized at bootstrap, admission, and mutation ingress. The rendered envelope propagates helper failure status, and admission rejects envelopes that omit or displace that propagation.

Preserved invariants

• lifecycle status does not create unknown features
• first write requires a valid feature slug and current in-worktree source evidence
• helper and repository identity remain bound to the selected workspace
• raw managed-path writes, spoofed helpers, mixed roots, and malformed envelopes fail closed
• existing saved drafts require no migration
• embedded and detached modes share the same resolver contract

Conformance

The deterministic harness exports Boatstack into temporary synthetic repositories, obtains the command from flow bootstrap, replays Cursor, Claude, Codex, and Gemini hook payloads, executes the admitted command in real shells, and verifies exact artifact bytes and failure status.

Required conformance uses no provider APIs, API keys, installed host applications, network access, or logged-in sessions.

Test Plan

• go build ./...
• go vet ./...
• go test ./... -count=1 -timeout=12m
• python3 -m unittest discover -s .github/tests -p "test_*.py" -v
• python3 .github/scripts/release_notes.py validate --repo .
• python3 .github/scripts/release_notes.py preflight --repo . --base-branch main
• required GitHub Actions matrix: Ubuntu, macOS, and Windows shards 0–5

Release note: release-notes/2026-08-10-bootstrap-command-authority.md