fix(feature): make generated plane policy canonical

[matdev83]

Changes

• capture complete private canonical metadata for every standard plane exactly once during generated initialization
• route generated contribution, request freeze, validation, replay/candidate replay, identity, diagnostics, hooks, and binders through captured policy/access
• make changed-ID Get and FrozenIdentity fail closed
• add isolated global descriptor mutation regressions and AST generator ratchets

Verification

• generator regeneration and -check pass
• feature SDK and archtest pass
• external feature SDK fixture passes
• runtime-sensitive and migrated-feature focused suites pass
• quality scope passes; aggregate quality remains blocked only by pre-existing unrelated lint debt
• same-host benchmark allocation/B-op counts unchanged across all cases

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: c38bfb58-85bb-406a-9d0a-82ab9fa62c1e

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}