feat: P1 bugfixes, security hardening, and plan system improvements

[nigel-dev]

Summary

Batch of 8 issues covering the entire P1 bug/security tier plus high-impact plan system improvements. All changes target the orchestrator, tool layer, and core libraries — no breaking API changes.

Changes

• feat: Support custom base branch for mc_launch and mc_plan #40 feat: Custom base branch support for mc_launch, mc_plan, mc_pr, mc_diff, mc_sync, mc_merge — thread baseBranch end-to-end through the full job lifecycle
• security: Sanitize worktreeSetup.commands before shell execution #24 fix(security): Sanitize worktreeSetup.commands — dangerous pattern detection (backticks, $(), eval, curl|sh, etc.) with warnings before execution; allowUnsafeCommands config flag to suppress
• bug: isPaneRunning swallows all errors — can cascade-fail entire plan #12 fix: isPaneRunning now distinguishes dead panes from tmux infrastructure failures — retry with 500ms backoff, isTmuxHealthy() health check, monitor/orchestrator handle errors gracefully instead of cascade-failing plans
• feat: Plan jobs should branch from integration HEAD, not main — dependencies are ordering-only #33 feat: Plan jobs with dependsOn now branch from integration HEAD (not main), so downstream jobs can see upstream code changes — root jobs branch from baseCommit for consistency
• bug: Plan job branches can collide with standalone jobs — no plan-scoped naming #34 fix: Plan job branches scoped to mc/plan/{shortPlanId}/{jobName} to prevent collisions with standalone jobs
• bug: Reconciler race condition silently drops state transitions #15 fix: Reconciler race condition — replaced boolean isReconciling guard with dirty re-reconcile pattern (reconcilePending flag + do/while loop) so state transitions are never silently dropped
• bug: mc_sync targets HEAD@{upstream} instead of base branch — can no-op or sync wrong ref #32 fix: mc_sync defaults to local base branch via getDefaultBranch() instead of HEAD@{upstream} — added source parameter (local/origin) for explicit control; fetch only runs when syncing from origin
• bug: Plan jobs ignore omo.defaultMode — hardcoded to vanilla #13 fix: Plan jobs respect omo.defaultMode config — mode resolution priority: per-job override → config default → vanilla; includes OMO detection, plan copying, and prompt transformation for non-vanilla modes

Testing

• bun run build passes
• bun test passes (600 tests, 0 failures)
• Manual testing done — launched job with baseBranch, verified mc_diff, mc_merge target correct branch, cleanup works
• 72 new tests added across 6 test files

Notes

• 22 files changed, +1088 / -103 lines
• All 8 issues were implemented as parallel mc_launch jobs targeting development, synced and squash-merged with conventional commits
• The 1 pre-existing flaky integration test (orchestration integration suite > runs in an isolated subprocess) was confirmed flaky on the base branch — not introduced by these changes
• #33 and #34 interact in orchestrator.ts:launchJob() — both plan-scoped naming and integration branching are applied together

Closes #40, closes #24, closes #12, closes #33, closes #34, closes #15, closes #32, closes #13