Design: run Chopin's harnesses on a connected machine

[lavaman131]

Design only. It proposes running a document's Planner on a member's connected machine, with the same Atomic and Copilot SDK adapters the server runs. The full design is in docs/harness-on-machine-design.md.

For a person, this changes four things:

• A document's Planner can run on your own machine, with your model login, your repositories and your tools.
• You set it up with the chopin connect you already run for builds. There's no separate Planner program.
• The extensions and skills you pass to your agent load for builds and for the Planner.
• One connection per machine carries every document whose Planner that machine runs.

The doc's "What this replaces" table lists the server setting, connect options, credentials and wire version this design retires.

Decisions

1. Every Planner that doesn't run on the server runs through a connected machine on chopin.agent.v2, including a person's own.
2. The adapter runs inside the connector process first, behind an interface.
3. Default machine runs the Planner on the creator's machine, using today's rule.
4. Moving a document with live workflow runs asks the owner to confirm first.
5. Atomic comes from a managed install, at the version the server asks for.
6. Extension tools reach Planner turns only with --planner-tools.
7. Each machine runs at most 2 Planner sessions by default. Live workflow runs don't use a slot.
8. A server running PLANNER_ON=machine uses one HARNESS adapter.
9. A connector restart keeps ownership through the grace period.
10. A machine has no limit on live workflow runs.
11. Each chopin release declares the Atomic versions it supports and refuses others with harness-unsupported.

The rollout is 9 stacked PRs. Each has a one-line acceptance test in the doc.