Expose a read-only repository planning API with an injected command backend

Goal and scope

Introduce executeRepositoryPlan(argv, { execute } = {}) for repository planning of labels, milestones, templates and files. This is a separate feature candidate, not an additional acceptance requirement for #15.

The native CLI remains the product entry for Projects and apply. Exclude mutations through the API, new schema/default/flag/version fields, workflow activation, branch-protection features, live credentials, sandbox guarantees and release changes. A supplied backend is trusted code, not a security sandbox.

Dependencies and coordination

Build on merged command transport PR #47 and merged minimal-CLI fixture extraction PR #48. These are delivered foundations, not outstanding issues; enabled-family/guard characterization is still CLI-2 work. Milestone and scheduling are deliberately unassigned; the approved B01→B06 order is unchanged. This issue is proposed, not a reservation or implementation grant. Recheck dependencies, assignees, claims and related PR before any explicit start.

Acceptance criteria

• Plan all four supported resource families with the same target/config/observed/plan and canonical authorization kernel as the native CLI.
• Reject apply, including authorized apply, before command-runner construction, config discovery or backend execution; an earlier rejection by the existing parser remains valid.
• Validate/normalize actual config, reject an active Project before target/backend discovery, and prevent caller extras from bypassing this private policy.
• Preserve legacy native Projects/apply behavior and ghJson(args, options)/ghTry(args, options) calling contracts.
• Return a fresh { report, exitCode } per supported call, with 0/1 outcomes, no process exit or console transport, and no cross-call mutable backend state.
• Cover import safety, native/default/injected backends, apply refusal, config/project policy, backend validation, command errors and malformed JSON, output freshness and sequential/concurrent isolation. Document argument/type boundaries rather than promising universal error capture.
• Keep callback identity/private policy out of serialized config, plan and authorization hashes.
• Verify the API selects only read/discovery requests and performs no product apply/file-write path. Disabled families issue no family-specific requests; global discovery may remain.

ODD phases

Forecasts for CLI-2/3/4 are respectively 360–439, 100–150 and 320–370 changed lines. They are not measured fits, minimums or permission to write. CLI-2's forecast crosses the 400-line cap; actual fit is unproven. Its next gate is an explicitly authorized bounded design/measurement attempt, not source implementation. No cap exception or scope split is inferred from a forecast. Form and measure the whole proposed unit in RAM before writing anywhere; if it exceeds 400 additions+deletions, stop without compressing code, dropping assertions or deferring essential tests/docs. Moves count twice.

Delivery

Use meaningful test-first evidence where applicable, proportionate checks otherwise, and independent verification according to risk. Separate authorization remains necessary for implementation and each delivery operation. No hidden helpers, live API validation or release claim is implied.