PA-4: improve-orchestration planner (CLI-only, dry-run, safe paths)

[a6b8]

Memo 097 Phase A. Thin orchestration planner: explicit --ns list (no board default), collects per-namespace worklist via CLI only (grading worklist --json), derives deterministic SAFE manifest paths (ORC-005 guard mirrors FleetRunner FLEET-005, rejects src/prompts/skills/spec/tests/scripts/docs), bounded parallelism P<=8, --dry-run demonstrable, errors collected never swallowed. Script produces manifests for the AI harness (does not spawn LLM sub-agents). +15 tests; 660/660 green.