Add M1 plan, given tests and fixtures, AGENTS.md and implementer log

Seven task files for the implementing model under docs/plans/M1/, with
the test files, byte-exact fixtures, Makefile, deny.toml and gate-script
self-test they copy into place. All of it was verified against a private
reference implementation: the gate passes after every task in order.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs/plans/M1/files/crates/proto/tests/fixtures/grant/bad_mode.toml

@@ -0,0 +1,3 @@
+tool = "read_file"
+mode = "always"
+max_taint = "private"

docs/plans/M1/files/crates/proto/tests/fixtures/grant/full.toml

@@ -0,0 +1,12 @@
+tool = "http_fetch"
+mode = "ask"
+max_taint = "secret"
+result_class = "public"
+untrusted = false
+expires = "2026-12-31T00:00:00.000Z"
+secret = "example-api-token"
+
+[constraints]
+paths = ["/home/kyle/notes/**"]
+hosts = ["example.com", "api.example.com"]
+patterns = ["^GET "]

docs/plans/M1/files/crates/proto/tests/fixtures/grant/minimal.toml

@@ -0,0 +1,3 @@
+tool = "read_file"
+mode = "auto"
+max_taint = "private"

docs/plans/M1/files/crates/proto/tests/fixtures/grant/missing_max_taint.toml

@@ -0,0 +1,2 @@
+tool = "read_file"
+mode = "auto"

docs/plans/M1/files/crates/proto/tests/fixtures/grant/unknown_constraint.toml

@@ -0,0 +1,6 @@
+tool = "read_file"
+mode = "auto"
+max_taint = "private"
+
+[constraints]
+path = ["/etc/**"]

docs/plans/M1/files/crates/proto/tests/fixtures/grant/unknown_field.toml

@@ -0,0 +1,4 @@
+tool = "read_file"
+mode = "auto"
+max_taint = "private"
+max_tiant = "secret"