fix(checkup): bind plan and apply to explicit provider homes

[NickyLam]

Summary

Checkup plan/apply was Qoder-hard-coded:

1. buildCheckupPlan() always emitted qoder-cli / qodercli disable mutations for candidates, including when scan.provider was codex, cursor, or another host.
2. resolveSourceRef() and scan fingerprints always bound provider-home to Qoder home, so a patch could resolve into another host's configuration root.

This change makes plan/apply provider-aware and fail closed (roadmap HA-02):

• only provider=qoder can produce or execute automatic qodercli disable actions
• other hosts keep candidates as manual-review until a provider-native apply contract exists
• provider-home source resolution and fingerprints bind to the explicit host home
• apply rejects cross-provider qoder-cli mutations before spawning a process

Why

• Issue/Story: roadmap.md Host Adapter Enablement HA-02 (no open GitHub bug issue; GitHub Secret Guard skips write payloads and camelCase tool inputs #11–cloc follows tracked symlinks outside the repository #18 were already closed via fix(harness): fail closed at review and privacy boundaries #19)
• User or maintainer outcome: Codex/Cursor checkup plans no longer recommend or execute Qoder CLI actions, and source patches cannot route through another host's home

Traceability and Scope

• Spec/ADR: docs/specs/2026-07-31-ha02-provider-aware-checkup-plan.md
• Acceptance criteria addressed: AC-1 through AC-5
• Canonical owners changed: scripts/coding-agent-practices/checkup/
• Explicit non-goals: HA-01 capability profiles; no new non-Qoder automatic apply contracts

Change Type

• Feature
• Bug fix
• Tests only
• Documentation/community
• Refactor with no intended behavior change
• Dependency, packaging, or infrastructure

Test and Review Evidence

Check	Result
node --test test/harness-checkup.test.mjs	26/26 pass
node --test test/harness-checkup.test.mjs test/support-declarations.test.mjs test/doc-link-graph.test.mjs	38/38 pass
Manual repro after fix	codex/cursor plans emit only manual-review; Codex provider-home resolves under codexHome, not Qoder home

Risk and Recovery

• Compatibility and cross-platform impact: portable path resolution; Windows/macOS/Linux covered by existing path helpers and unit tests
• Package, plugin, schema, or generated-file impact: plan action shapes for non-Qoder hosts now use manual-review instead of qoder-cli; Qoder path unchanged
• Rollback or recovery path: revert the single commit
• Residual risk: source-patch still applies only under workspace or the bound provider home; no new host mutation executor is claimed

AI Involvement

• Level: Assisted
• Human review and validation: focused Node tests and manual provider binding repro recorded above

Checklist

• I followed AGENTS.md, CONTRIBUTING.md, and the relevant canonical-owner guidance.
• The change is focused and does not include unrelated local or generated state.
• Tests and documentation match the behavior actually delivered.
• Markdown links were checked when documentation moved or changed.
• Cross-platform behavior was considered for Windows, macOS, and Linux.
• Package/runtime verification was run when shipped files or dependencies changed. Not applicable: no package bundle or dependency change.
• User-facing or compatibility changes are recorded in CHANGELOG.md.
• I have the right to contribute this work under the repository's MIT License.