Add control-plane BootReleaseSet safe planner

[mdheller]

Summary

Adds a pure, non-mutating planner that consumes the canonical sourceos-spec control-plane BootReleaseSet shape and emits a safe ControlPlaneBootPlan for sourceos-boot.

Scope

• Adds sourceos_boot.control_plane planner module.
• Adds plan-control-plane CLI command.
• Adds a sourceos-spec-shaped control-plane BootReleaseSet fixture.
• Adds tests proving the planner emits:
  • action mapping from boot channel;
  • policy ref;
  • artifact refs;
  • proof report requirements;
  • offline fallback posture;
  • verification gates;
  • execute=false.
• Rejects unsafe states such as draft BootReleaseSets and unsigned offline fallback.

Non-goals

• Does not perform network fetches.
• Does not write disks.
• Does not call kexec.
• Does not install or roll back a host.
• Does not replace the native sourceos-boot v1 schema.

Validation

Expected CI:

python src/sourceos_boot/validate_boot_release_set.py examples/*.json
python -m pytest

Depends on the hardened control-plane schema landed in SourceOS-Linux/sourceos-spec#65.