Implement .commit-ci-preflight.toml, explicit argv commands, dependency DAG validation, bounded limits, deterministic plan digest, and a read-only ccp plan command. Cover cycles, duplicate IDs, unsafe paths, unknown keys, environment allowlists, deterministic ordering, and oversized plans. No process execution in this tranche.
Implement .commit-ci-preflight.toml, explicit argv commands, dependency DAG validation, bounded limits, deterministic plan digest, and a read-only ccp plan command. Cover cycles, duplicate IDs, unsafe paths, unknown keys, environment allowlists, deterministic ordering, and oversized plans. No process execution in this tranche.