Issue/13 plan risk

[leo-aa88]

Changes

• internal/plan/risk.go — summarizeRisks walks plan operations and compares prior NormalizedSpecJSON vs desired JSON for Policy, Agent, and Tool:
  • Policy (update): higher spec.execution.maxTotalCostUsd → message containing “cost ceiling increased”; any spec.approvals.requiredFor entry dropped → “Approval requirements removed…”
  • Policy (create, no prior row): conservative lines when a cost ceiling or approvals are defined
  • Agent (update): model change → “Agent model changed…”; create → note when a model is bound
  • Tool (update): new permissions.allow entries vs old → if ActionSuggestsWriteSideEffects matches any addition → “New write-like tool permissions added…”; create → same style when any allow matches the heuristic
• ActionSuggestsWriteSideEffects — documented MVP heuristic: case-insensitive substring checks for write, delete, merge, .send, .post (see comment on the function).
• internal/plan/plan.go — RiskSummary now has Messages []string (deduped, sorted).
• internal/plan/planner.go — ComputePlan sets Risk: summarizeRisks(...).
• internal/plan/output.go — FormatPlan appends a Risk delta section when there are messages.
• internal/plan/risk_test.go — TestRiskSummary_costCeilingIncreased, TestRiskSummary_newWriteLikeToolPermissions, baseline TestRiskSummary_newToolCreate_flagsWriteLikeWhenNoPriorState, plus table test for ActionSuggestsWriteSideEffects.

Acceptance

Criterion	Test
Raising maxTotalCostUsd → “cost ceiling increased”	TestRiskSummary_costCeilingIncreased
Adding a tool allow that matches the heuristic → write-permission style risk	TestRiskSummary_newWriteLikeToolPermissions

Closes #13.