Validate planning-only native stack layers without relabeling inherited runtime proof #760

Stack #759 contains an implemented security layer (#719) followed by planning-only #743/#751. The current Requirements gate selects the whole stack diff and applies one global test-authored acceptance record to unrelated deferred proposals, blocking valid planning layers.

Implement a protected-base, fail-closed planning boundary only when every post-root path is a regular, non-executable OpenSpec planning file and the inherited implementation source/mapping/tests/support remain unchanged. Independently authenticate successful exact-root Requirements and member-authority runs, then validate all post-root planning sources at planned maturity in producer, execution and final consumer. Retain the full existing verified/RED path for every runtime, test, workflow, delivery, protected-source, symlink or rename change. No fixture change, inferred acceptance, waiver or runtime maturity claim for planning.

Follow spec -> tests -> real RED -> code -> GREEN, normal signed commits and all required gates. This prerequisite requires reviewed integration before candidates can use its trusted policy. Related #718/#742/#749/#750; parent feature #355.