Name the room's document in read_plan and edit_plan results

Code running inside a Planner session, such as an Atomic extension that
writes to the room's document over MCP, had no reliable way to learn which
document the session belongs to (#366). read_plan and a successful edit_plan
now carry document: { id, url }, the channel id and canonical URL that MCP
read_document returns for the same document.

The identity is read from the plan's own channel record at call time, so it
follows a rename and never names another document. It does not depend on the
Planner's working directory, so rooms with and without a checkout report the
same value. read_document and invoke_planner share the new documentUrl helper
with the Planner tools instead of each building the path. Session-start
metadata is left out; the Planner already reads the document before relying on
it.

Closes #366

Assistant-model: Claude Opus 5.5 (fast)
Assistant-workflow: issue-to-pr
Assistant-duration: 9m converged, estimated 10m
Assistant-verification: bun test failed before the fix: tools.test.ts 2 fail with the tool change reverted (run with --preload harness/agents.ts to avoid an existing import cycle when the file runs alone)
Assistant-verification: bun test passed for the change: 4015 pass, 3 skip, 29 fail; every failure is scripts/pr-maintenance temp-repo git commits refused by the global ssh commit signing config, and those 166 tests pass with commit.gpgsign=false
Assistant-verification: bun run types passed: all workspace packages exit 0
Assistant-verification: bun run ci passed: dprint, oxlint (0 errors, 10 existing warnings), tokens, design contract, design record, Impeccable
Co-authored-by: Alex Lavaee <lavaman131@github.com>