YM-214 Unify strict runtime settings

[prineycom]

Summary

• Load one strict root runtime-settings snapshot and carry it through every public decision path.
• Make /do approval parent-owned, plan-bound, single-use, and compatible with documented conversational input.
• Enforce immutable ship merge gating and independent per-guard/runtime-cap policy across typed, tool, CLI, pane, ordinary, and coordinator surfaces.
• Add executable public-adapter coverage with exact passed case IDs for every applicable matrix cell.
• Isolate synthetic coordinator fixtures from inherited review-pane identity while exercising the regression under a complete fake pane stamp.

Verification

• pnpm ready YM-214: passed at 870bcc930353e90405b480a9f872c4556846fd11.
• pnpm exec tsc --noEmit: passed.
• pnpm test: 348 passed, 0 failed, 0 skipped.
• git diff --check: passed.
• Independent rework and post-merge integration reviews approved with no findings.
• GitHub checks checks and pi-loader-smoke: passed.

Integration notes

• Merged current origin/main; branch is 0 commits behind its base.
• The only other open PR, Isolate pnpm readiness installs #25, has no changed-file overlap with YM-214.
• The sole merge conflict was in AGENTS.md; the resolution preserves YM-214's exact recorded-plan binding and main's model-pool priority rules.

Ticket: https://yoke.youtrack.cloud/issue/YM-214