feat(cli): add plan subcommand

[nucleuskit]

Summary

Adds a new nucleus plan CLI subcommand that classifies requested tasks, proposes contract-first edit surfaces, reports blocked edits, and emits human-readable or machine-readable planning output.

It also refreshes the contract submodule pointer from bd52725 to 924d1bb and adds tests for plan output, blocked edits, pretty JSON, and the hello-http example.

Type

• Bug fix
• Feature
• Documentation
• Refactor
• Build or CI

Contract / Manifest Impact

• No public contract or manifest impact
• OpenAPI changed
• Protobuf changed
• api/errors.yaml changed
• nucleus.yaml changed
• Generated files refreshed

Additional impact: contract submodule updated from bd52725 to 924d1bb.

Verification

go test ./... -> passed: 25 tests in 6 packages
go test ./... -race -count=1 -> passed: 25 tests in 6 packages
go run ./cmd/nucleus validate --dir example/hello-http -> OK, 0 errors, 0 warnings
go run ./cmd/nucleus validate --dir example/hello-http --json -> ok=true
go run ./cmd/nucleus lint --dir example/hello-http -> OK, findings: 0
go run ./cmd/nucleus --dir example/hello-http plan --task "新增 HTTP 接口" --json -> ok=true, blocked_edits=[]

Note: go run ./cmd/nucleus verify --dir example/hello-http --json currently exits non-zero because this branch does not wire a verify subcommand; nucleus --help lists describe, lint, plan, and validate.

Risk

Low rollout risk for existing flows because this adds a new CLI subcommand and only wires it into the root command. Main review focus should be the new task classification and edit-surface heuristics, plus the updated contract submodule pointer.