feat: plan-mode handshake for interactive review skills

Add a preamble-level STOP-Ask handshake that fires when the user invokes any
of the 4 interactive review skills (plan-ceo-review, plan-eng-review,
plan-design-review, plan-devex-review) while their Claude Code session is
in plan mode. Without this gate, plan mode's "this supercedes any other
instructions" system-reminder outranked the skills' interactive STOP gates
and the skills silently wrote plan files without any per-finding AskUserQuestion.

The handshake offers 2 options (exit-and-rerun, cancel) — the original
third "stay and batch" option was dropped after two independent reviewers
flagged it as a silent bypass of the skills' anti-skip rule.

Architecture decisions (CEO+Eng review):
- Preamble-level resolver, not per-template injection (Codex finding #2)
- Position 1 in preamble composition: after bash block (_SESSION_ID live),
  before onboarding AskUserQuestion gates (so fresh-install users see the
  handshake first, not drowned in telemetry/proactive/routing prompts)
- Generator-only `interactive: true` frontmatter flag, following the
  `preamble-tier` precedent (no host-config frontmatter allowlist edits)
- Host-scoped to Claude via `ctx.host === 'claude'` check inside the
  resolver (simpler than `suppressedResolvers` which only gates `{{}}`
  placeholders)
- One-way-door classification in scripts/question-registry.ts for all 4
  skills so question-tuning `never-ask` preferences can't suppress the gate
- Synchronous telemetry write to ~/.gstack/analytics/skill-usage.jsonl on
  handshake fire (captures A-exit and C-cancel outcomes that terminate the
  skill before end-of-run telemetry runs)

Also adds an explicit STOP block to plan-ceo-review Step 0C-bis so the
approach-selection question can't silently skip to mode selection.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

scripts/question-registry.ts

@@ -261,6 +261,45 @@ export const QUESTIONS = {
     description: "Approve the design doc, revise sections, or start over?",
   },
 
+  // -----------------------------------------------------------------------
+  // Plan-mode handshake — fires at the top of any interactive review skill
+  // when the user is in plan mode. Safety-critical, always asked regardless
+  // of user's tuning preferences. See scripts/resolvers/preamble/generate-
+  // plan-mode-handshake.ts.
+  // -----------------------------------------------------------------------
+  'plan-ceo-review-plan-mode-handshake': {
+    id: 'plan-ceo-review-plan-mode-handshake',
+    skill: 'plan-ceo-review',
+    category: 'routing',
+    door_type: 'one-way',
+    options: ['exit-and-rerun', 'cancel'],
+    description: "Plan mode detected — exit and rerun interactively, or cancel?",
+  },
+  'plan-eng-review-plan-mode-handshake': {
+    id: 'plan-eng-review-plan-mode-handshake',
+    skill: 'plan-eng-review',
+    category: 'routing',
+    door_type: 'one-way',
+    options: ['exit-and-rerun', 'cancel'],
+    description: "Plan mode detected — exit and rerun interactively, or cancel?",
+  },
+  'plan-design-review-plan-mode-handshake': {
+    id: 'plan-design-review-plan-mode-handshake',
+    skill: 'plan-design-review',
+    category: 'routing',
+    door_type: 'one-way',
+    options: ['exit-and-rerun', 'cancel'],
+    description: "Plan mode detected — exit and rerun interactively, or cancel?",
+  },
+  'plan-devex-review-plan-mode-handshake': {
+    id: 'plan-devex-review-plan-mode-handshake',
+    skill: 'plan-devex-review',
+    category: 'routing',
+    door_type: 'one-way',
+    options: ['exit-and-rerun', 'cancel'],
+    description: "Plan mode detected — exit and rerun interactively, or cancel?",
+  },
+
   // -----------------------------------------------------------------------
   // /plan-ceo-review — scope & strategy
   // -----------------------------------------------------------------------