docs: define Project Profiles delivery plan

[siracusa5]

Summary

Defines the requirements and delivery plan for ContextCake Project Profiles, the next vertical slice that routes one global MCP registration to an isolated project-specific source stack. Captures the adversarial review and the resulting migration, privacy, cache-isolation, and write-safety requirements before implementation begins.

Changes

• add the Project Profiles requirements spec with deterministic profile selection, backward compatibility, isolation, Packs/team-sync, privacy, and dogfood acceptance criteria
• add a five-PR delivery plan covering Manifest v2, engine/MCP runtime selection, service APIs, Mac/Console UX, GitHub integration, testing, rollout, and reversal
• add an adversarial review record documenting seven blockers and how the final plan resolves them

Test Plan

• npm test
• planning document checks: whitespace, unresolved markers, balanced code fences, and referenced repository paths
• CI checks pass

Notes

• Documentation-only; no runtime behavior changes in this PR.
• The spec remains proposed and awaiting product approval; implementation is intentionally split into follow-up PRs.
• Private GitHub auth can remain a fast-follow, but the plan forbids raw-token shortcuts.