Harden plan builder lifecycle and agent setup

[jamil2018]

Summary

This PR packages the complete current AppraiseJS worktree and the related prior-session changes into one integration change against appraise-0.5.

It:

• makes Codex MCP registration use a repo-resolved stdio command and centralizes the expected agent capability catalog
• preserves project selection through a real redirect for unscoped resource URLs
• hardens validation AST identity, expected-red baseline matching, dry-run diagnostics, and generated binding deduplication
• repairs coordinator event acknowledgement routing, baseline evidence recovery, lifecycle health reporting, and completion replay idempotency
• supports defensive completion deep links
• preserves the full ForgotSomething happy-path plan, validation, baseline, implementation, and sign-off evidence
• synchronizes root changes into the create-appraisejs scaffold and refreshes committed Graphify outputs
• fixes template-step generation so structured-operation helpers remain imported during database-backed projection

Context and impact

The ForgotSomething end-to-end audit exercised the real Appraise-owned lifecycle through plan approval, validation review, expected-red baseline acceptance, implementation, managed validation, and final completion. It exposed several defects that only appeared when the workflow was carried through every gate.

The MCP setup changes also incorporate the earlier connection diagnosis: registration state, sidecar liveness, and task capability snapshots are separate concerns. Repo-local stdio registration avoids requiring a long-lived coordinator bearer token in the Codex environment and works even when the package binary is not globally installed.

The existing project-scope proxy change is included as requested. A redirect makes the project-selection handoff visible to the browser and preserves the intended return URL instead of internally rewriting an unscoped resource request.

Root causes addressed

• registration guidance pointed Codex at an unauthenticated HTTP endpoint and duplicated capability lists
• operation policy registered /events while clients acknowledged through /events/ack
• repeated generated Cucumber expressions could create ambiguous dry runs
• dry-run reconciliation collapsed undefined/ambiguous steps into scenario-count errors
• baseline evidence loading attempted to read a missing report before returning evidence-health blockers
• expected-red evidence compared local AST IDs with stable executable/Gherkin identities
• lifecycle health counted only implementation runs and omitted terminal baseline reconciliation problems
• final completion replay was not idempotent after browser sign-off
• template-step projection regenerated a fixed import list that omitted structured-operation helpers still used by generated definitions

Validation

• focused root regression suite: 59 tests passed
• packages/appraisejs: 119 tests passed
• packages/create-appraisejs: 65 tests passed
• full ESLint: 0 errors; 13 existing/generated warnings
• npm run build: passed
• npm --prefix packages/create-appraisejs run build: passed
• agent harness check: passed, 40 files
• generated-artifact policy: passed, 7,707 tracked paths
• package-content checks: passed
• Fallow staged gate: passed with no introduced dead code, complexity, or duplication
• React Doctor staged gate: 100/100
• git diff --check: passed
• ForgotSomething managed validation: 40/40 steps passed, 5/5 tasks verified, lifecycle completed

Notes

The production build retains seven known Turbopack broad dynamic-path warnings. Full lint also reports warnings from immutable generated runtime capsules plus two existing source/test warnings; there are no lint errors.