Run every atomic Planner session as a full Atomic session

HARNESS=atomic is now the only switch. Every Planner session on that
harness, local or hosted, runs as a full Atomic session: builtins,
default coding tools, the operator's Atomic resources, and Chopin bound
as HostInput. The summary and research workers keep their isolated
sessions, and copilot-sdk and pi are unchanged. This supersedes the
local-only opt-in from c84fa4e. Its environment variables and
Config.atomicPlanner are gone, and nothing replaces them.

A checkout now comes only from invoke_planner. On the atomic harness it
is verified against the document's origin before anything is posted,
then remembered in memory for that channel. Every later Planner session
re-verifies it before use, whether it starts from the browser or MCP.
Without a remembered checkout, the session runs with the same tools in
an empty 0700 directory created for that channel alone and removed at
shutdown. The Planner's instructions say which case applies.

Host input expires after a fixed 30 minutes. The questionnaire record
and question:resolved now carry an "expired" status. The card stays in
the document with status="expired" and is listed among the resolved
Decisions, with a note that nobody answered and the Planner will use its
best judgement. Atomic receives no answer, and late submissions are
refused. An abort or member cancel still withdraws cards as before.

invoke_planner is offered for every harness and auth mode. The posted
message is attributed to the caller. The turn runs under the channel's
existing owner, or the caller's live browser login claims ownership, or
the call is refused before anything is posted. Other harnesses ignore
the checkout.

Assistant-model: Claude Opus 5.5
Assistant-workflow: goal (run 98acf681-3730-4957-b885-0d70e0e6b32a)
Assistant-verification: bun test passed: 1746 pass, 2 PostgreSQL skips, 0 fail, 7619 assertions across 196 files
Assistant-verification: focused bun test (harness, mcp, chat, config, question, protocol) passed: 390 pass, 0 fail, 1821 assertions across 38 files
Assistant-verification: worker isolation mutations passed: BUILTINS_OFF set true failed 17 of 34, isolated skill discovery failed 2, the result tool offered on plain turns failed 11; the adapter was restored byte-for-byte
Assistant-verification: behaviour mutations passed: never registering atomic sessions, withdrawing on expiry, rejecting expired records on restore, and refusing an owner other than the caller each failed their new tests; every file was restored byte-for-byte
Assistant-verification: bun run types passed: all workspaces and E2E
Assistant-verification: bun run fix passed: formatted changed files and one untracked .atomic todo, which was restored byte-for-byte; one existing lint warning
Assistant-verification: bun run ci failed: dprint flagged only one untracked .atomic/todos file; dprint check on the tracked and new files, oxlint, token, type-scale and design checks then passed
Assistant-verification: relative-link check passed: every relative link and anchor in README.md, AGENTS.md and docs resolves with exact casing
User-preference: "Atomic's SDK is the runtime and the host supplies human input; Chopin implements HostInput rather than intercepting tools"
User-preference: "In local mode the Planner may run as a full Atomic session so workflows run inside Chopin with questions in Decisions"
User-preference: No extra per-harness flags; HARNESS=atomic always runs the Planner as a full Atomic session, hosted included
User-preference: No extra per-harness env settings; the checkout comes from invoke_planner and the input timeout is a code constant
Co-authored-by: Alex Lavaee <lavaman131@github.com>