Enforce LAW 7 (--plan) for agent-hosted runs; reminder is skipped when an internal planner is configured or fails

Problem

SKILL.md LAW 7 says the hosting reasoning model (Claude Code, Codex, Hermes, Gemini) must write the query plan and pass --plan. The engine only enforces that with a stderr reminder, and in planner.plan_query() the reminder prints only when no engine-internal reasoning provider is configured.

When a provider key happens to be in the environment, an agent-hosted run that skips --plan quietly takes the engine-internal path instead. In our case it was an OPENROUTER_API_KEY exported for an unrelated tool.

• If the provider works, the run spends on the internal planner instead of the host writing the plan.
• If the provider fails (we hit HTTP 402 "Insufficient credits" from OpenRouter), plan_query() returns the deterministic fallback straight from the except branch, with no LAW 7 reminder at all.

The agent gets a degraded run and never learns it skipped planning. We saw this from a Claude Code subagent that ran the engine without --plan: the planner fell back, and the run went ahead with no sign the plan step had been skipped.

Proposed Solution

Enforce LAW 7 in the engine when it can tell it's running under an agent host:

• Detect agent hosts from the environment variables they already set: CLAUDECODE / CLAUDE_CODE_ENTRYPOINT (Claude Code) and CODEX_THREAD_ID / CODEX_SESSION_ID / CODEX_SANDBOX (Codex). Also accept an explicit LAST30DAYS_HOST_AGENT=1.
• Stop before planning: in a detected agent-hosted research run with no --plan, the engine skips its internal LLM planner and stops before retrieval with a non-zero exit and the LAW 7 message pointing at Step 0.75 and the --plan tmpfile pattern.
• Keep the modes SKILL.md already allows without a plan (hiring signals, discovery/nomination, finalize, mock, doctor/setup/diagnostics, watchlist and library commands).
• Add an override: LAST30DAYS_ALLOW_ENGINE_PLAN=1 restores today's behavior for headless or cron jobs launched from inside an agent.
• Keep the reminder elsewhere: outside detected agent hosts, still print the LAW 7 reminder when the internal provider fails, not only when none is configured.

Alternatives Considered

• Only print the reminder on the provider-failure path. It's cheaper, but the existing reminder has already been ignored (see the 2026-04-19 Hermes note in SKILL.md), and it still lets agent-hosted runs spend on the internal planner.
• Always require --plan. That would break the documented headless and cron paths.

I'll open a PR with this and tests.