cawplan-plan-create

The workflow is coherently scoped to CawPlan release planning and includes safeguards against unconfirmed writes. The main concern is the required CLI's unverified provenance; this warrants elevated supply-chain risk, but the supplied content does not establish malicious behavior.