feat(plane): increment manifests for the 46-candidate validation run (task 7)

Model deepseek-flash (declared provider extension, endpoint prices in
parameters, secretKey naming the DEEPSEEK_API_KEY secret), digest-pinned
Task templates repo-facts / verify / agree, and a generator
(plane/generate.py, `ousast plane workspaces --validation-set ...`) that
emits per case the vulnerable-pin Workspace, a files-only inputs Workspace
(recorded candidates after the recorded triage, declared sites, triage),
per-case Tasks and one Run validation-46: facts -> verify a, verify b ->
agree for the 15 cases, 46 candidates (43 kept), budgets 1.5x the recorded
per-pass share. A Run entry cannot add a binding or env, and Run.inputs
names only task artifacts, so the case is fixed by per-case Tasks.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

benchmarks/measurements/2026-09-08-module-audit.json

@@ -1,7 +1,7 @@
 {
-  "modules": 128,
+  "modules": 129,
   "counts": {
-    "load_bearing": 119,
+    "load_bearing": 120,
     "standalone_capability": 9
   },
   "orphaned": [],
@@ -659,6 +659,7 @@
       "reason": "ai-service-plane Req 1-4: the service plane package; runner and reconciler integration in tasks 3-4",
       "importers": [
         "cli",
+        "plane.generate",
         "plane.reconciler",
         "plane.runner",
         "plane.tasks.verify",
@@ -673,11 +674,20 @@
         "plane.tasks.verify"
       ]
     },
+    {
+      "module": "plane.generate",
+      "classification": "load_bearing",
+      "reason": "ai-service-plane task 7: an increment's Workspaces, per-case Tasks and Run from a recorded set",
+      "importers": [
+        "cli"
+      ]
+    },
     {
       "module": "plane.manifests",
       "classification": "load_bearing",
       "reason": "ai-service-plane Req 1.1-1.4: ax-shaped Task/Workspace/Model and the Run kind, validated before anything runs",
       "importers": [
+        "plane.generate",
         "plane.reconciler",
         "plane.runner",
         "plane.workspaces"
@@ -688,6 +698,7 @@
       "classification": "load_bearing",
       "reason": "ai-service-plane Req 3.1-3.5, 7.3: ax-backed Run execution, status attribution and doctor; `ousast plane`",
       "importers": [
+        "plane.generate",
         "plane.workspaces"
       ]
     },
@@ -702,6 +713,7 @@
       "classification": "load_bearing",
       "reason": "ai-service-plane Req 4.1: the task entrypoint package the runner imports by name; runner integration pending (task 3)",
       "importers": [
+        "plane.generate",
         "plane.tasks.agree"
       ]
     },
@@ -722,6 +734,7 @@
       "classification": "load_bearing",
       "reason": "ai-service-plane Req 5.3/2.1-2.3/7.2: the batched hunt with known callers, metered and resumable per file hunt",
       "importers": [
+        "plane.generate",
         "plane.tasks.agree"
       ]
     },