feat(planning): show the constraint ledger on the interview page and in export-brief #9720

Parent

Refs #5796

Depends on

• none: on the frontier now

Outcome

The interview's constraints are visible on the page and reach the Brief (gap G8):

• A constraint op records a constraint; the header shows a "Constraints (N)" panel listing them.
• export-brief --ledger reads the ledger's ## Constraint ledger section when no confirmed restatement
  supplies constraints, instead of printing "Constraints: none recorded".

Decisions

• planning: mark interview recommendations stale when a new constraint arrives mid-interview #5769 (owner, 2026-10-18, option (a)) owns per-question "checked against" data and staleness from a new
  constraint; this slice does not add them.

Key interfaces

• Interview page: plugins/planning/surface/index.html; page server: plugins/planning/surface/server.py
  (record(), derive_states); round CLI: plugins/planning/surface/round.py behind round.sh;
  exporters: plugins/planning/surface/exporters.py.
• The interview skill's surface contract, plugins/planning/skills/interview/context/surface.md, documents
  every new op, field, setting and refusal.

Done when

• A round test applies a constraint op and finds it in the page state.
• A page test shows "Constraints (2)" for a fixture with two constraints.
• An exporter test runs export-brief --ledger on a ledger with a ## Constraint ledger section and no confirmed restatement, and the output lists each constraint.
• scripts/run-test-file.sh plugins/planning/surface/test_server.py exits 0.
• scripts/run-test-file.sh plugins/planning/surface/test_round.py exits 0.
• bash plugins/planning/surface/surface.test.sh exits 0, so a data dir without the new fields still loads, renders and exports.
• scripts/check-changelog-fragments.sh --check-required origin/main exits 0.

Out of scope

• Per-question checked-against chips, re-check lists and stale marking (planning: mark interview recommendations stale when a new constraint arrives mid-interview #5769).