Phase 2c: persist messaging plan in session for resume

[sandl99]

Summary

Track phase 2c of the manifest-first messaging migration: persist the compiled SandboxMessagingPlan in the onboard session file so that --resume runs can restore enrollment state without re-running interactive hooks.

Scope

• Add messagingPlan: SandboxMessagingPlan | null to the Session interface and SessionUpdates type.
• Persist the compiled plan to session after setupMessagingChannels() completes during the sandbox step.
• On the non-interactive resume path, restore the persisted plan to NEMOCLAW_MESSAGING_PLAN_B64 before createSandbox is called, so MessagingHostStateApplier.readPlanStateFromEnv() sees it and the registry entry retains its messaging field across rebuild.
• Export readMessagingPlanFromEnv and writePlanToEnv from messaging-channel-setup.ts to keep src/lib/onboard.ts from growing.

Non-goals

• Do not store hook execution results (credential hashes, auth tokens) in the session yet.
• Do not add mid-hook resume capability.
• Do not remove legacy messagingChannels / messagingChannelConfig session fields.

Tracking

PR: #4901

Parent: #3896