Add LLM-backed planning agent (A4/A11/A13) — step 5a

- planner.py: LLMPlanningAgent offers exactly two tools, submit_plan
  and ask_human, so gating stays structural at the tool layer; no
  proceed tool exists. System prompt requires explicit, low-inference
  plans because a weaker model executes them (A13)
- Model output is appended to the canonical log as it arrives, before
  being interpreted, so a crash mid-planning leaves a truthful
  transcript
- A bad turn (prose instead of a tool call, malformed arguments, or a
  failed call) retries once, then raises PlanningError; the
  orchestrator gates to AWAIT_INPUT rather than inventing a plan
- Orchestrator: appends every operator message, plan_submitted, and
  gate_opened to the transcript, so re-planning sees rejection
  feedback as conversation rather than out-of-band parameters; pins
  the A11 role mapping at task start
- llm.py: non-JSON or non-object tool arguments now raise LLMError
  instead of escaping as JSONDecodeError — observed from llama3.2,
  which emits truncated argument strings
- Live planning test is opt-in on NISSE_LIVE_PLANNER_MODEL: planning
  escalates unconditionally (A12) and the local model does not hold
  the tool-call contract, so it awaits a frontier route

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.env.example

@@ -11,6 +11,12 @@ NISSE_ROLE_PLANNER=anthropic/claude-opus-5
 NISSE_ROLE_DELEGATE=anthropic/claude-opus-5
 NISSE_ROLE_CONSULTANT=anthropic/claude-opus-5
 
+# Opt-in for the live planning test: set to a frontier model the virtual key
+# can reach. Planning escalates unconditionally (A12) and small local models
+# do not hold the tool-call contract reliably, so this stays unset until a
+# frontier route exists.
+# NISSE_LIVE_PLANNER_MODEL=anthropic/claude-opus-5
+
 # --- Matrix transport (A1), used by nisse-dev's MatrixTransport ---
 NISSE_MATRIX_HOMESERVER=https://matrix.example
 NISSE_MATRIX_USER_ID=@nisse-dev:example