feat(kernel): read-only mode after read-before-write + mandatory task-decompose gate

Two orchestrator tool-gating behaviors (both touch SessionOrchestrator):

- Read-only switch: when a tool call is BLOCKed with READ_BEFORE_WRITE, derive a
  read-only mode from the event log (block until a later FILE_READ completes) and
  withhold FILE_WRITE tools from the next inference turn(s), so a weak model is
  pushed down the read-then-write path instead of looping on the blocked write.
- require_task_decompose stage flag (TomlWorkflowLoader) + owesTaskDecompose guard:
  a stage so marked cannot stage_complete until a task_decompose/task_create has
  succeeded this stage. New task_planning workflow + prompt are the first consumer
  (decompose-only: swoop codebase, emit a parent + DEPENDS_ON task graph, stop).

examples/workflows/task_planning.toml

@@ -0,0 +1,21 @@
+id = "task_planning"
+description = "Sweep the codebase, understand the request, emit a task graph via task_decompose — then stop. No execution."
+start = "planner"
+
+# Single stage: read the request + codebase, emit a task graph, done.
+# require_task_decompose = true is a deterministic kernel gate: stage_complete is blocked
+# until task_decompose (or task_create for a trivial single-task request) returns successfully.
+# The model cannot skip task creation — this is enforced by the orchestrator, not just the prompt.
+[[stages]]
+id = "planner"
+prompt = "prompts/task_planner.md"
+allowed_tools = ["file_read", "ShellTool", "task_search", "task_context", "task_decompose", "task_create"]
+require_task_decompose = true
+token_budget = 16384
+max_retries = 2
+
+[[transitions]]
+id = "planner-to-done"
+from = "planner"
+to = "done"
+condition_type = "always_true"