Name the document in edit_plan refusals too

edit_plan returned document: { id, url } only on success. A locked, stale,
or invalid refusal left it out, so code inside the session still had no
identity when the first edit it saw was refused. Every edit_plan result now
carries the same identity read_plan returns, read before the room lock as
before.

Refs #366

Assistant-model: Claude Opus 5.5 (fast)
Assistant-workflow: issue-to-pr
Assistant-duration: 22m converged, estimated 10m
Assistant-verification: bun test failed before the fix: tools.test.ts 2 fail with the tools.ts change reverted (identity and locked-refusal tests)
Assistant-verification: bun test passed for the change: 4044 pass, 3 skip, 0 fail with command-scoped commit.gpgsign=false; the default run has 29 fails, all scripts/pr-maintenance temp-repo commits refused by global ssh signing
Assistant-verification: bun run fix passed: 0 errors, 10 existing warnings, no changes to the diff
Assistant-verification: bun run types passed: all workspace packages exit 0
Assistant-verification: bun run ci passed: dprint, oxlint (0 errors, 10 existing warnings), tokens, design contract, design record, Impeccable
Co-authored-by: Alex Lavaee <lavaman131@github.com>