Merge origin/master (plan line #590) into web-permission-sandbox-merge-master

Shared-surface conflicts resolve as unions: the fixture serves all five
projection keys (title/todos/permissions/plan/goal) with the /permission
and /plan command mirrors side by side, the connection specs assert the
five-key baseline and the shifted approval/question replay indices, and
the cli roster/deps, tsconfig aggregate, and README allowlist carry both
lines' rows. Plan-side content lands verbatim from master.

One end-state consolidation both branches half-did: with questions
(ui-question) and approvals (ApprovalPanel) each owning a composer
takeover, PendingCard retires outright — ChatView renders no pending
placeholder, the card component and its specs go, and both README halves
state the takeover-only contract.

tsconfig.client.json

@@ -46,6 +46,7 @@
     { "path": "./packages/client/ui-goal" },
     { "path": "./packages/client/ui-model" },
     { "path": "./packages/client/ui-permission" },
+    { "path": "./packages/client/ui-plan" },
     { "path": "./packages/client/ui-question" },
     { "path": "./packages/client/ui-trajectory" },
     { "path": "./packages/client/ui-theme" },