feat(server,kernel): post-plan approval gate — operator reviews plan before lock

After a freestyle plan compiles successfully, requestPlanApproval is invoked
before ExecutionPlanLockedEvent is emitted. Rejection emits
ExecutionPlanRejectedEvent(source="operator") with no lock and no phase-2 run.
Adds public SessionOrchestrator.requestPlanApproval seam delegating to
requestStageApproval, wired in Main.kt. Two new tests cover the reject and
approve paths; existing tests stay green via the default passthrough param.

core/kernel/src/main/kotlin/com/correx/core/kernel/orchestration/SessionOrchestrator.kt

@@ -1560,6 +1560,10 @@ abstract class SessionOrchestrator(
         }
     }
 
+    /** Public seam for out-of-band gates (e.g. freestyle plan review) that reuse the stage-approval flow. */
+    suspend fun requestPlanApproval(sessionId: SessionId, preview: String): Boolean =
+        requestStageApproval(sessionId, StageId("plan_review"), preview)
+
     // --- private functions ---
 
     private suspend fun handleApproval(