feat(apply): project on the plan wire + ownership preview annotation

§7 M3 (part 1): `pic plan` now surfaces the ownership outcome BEFORE apply.

- plan / plan_owner / plan_tree take the declaring `[project]`; each result
  carries an `ownership` preview (pure `preview_ownership`, unit-tested):
  claim (unclaimed + project), owned (already this project), conflict (owned by
  X — named), or unclaimed. A group node previews its OWN owner; an app node its
  nearest claimed ancestor (read-only, on the pool).
- the attach-point ceiling (M2) is now previewed at plan too, so `pic plan`
  outside the subtree fails early — consistent with apply.
- wire: PlanRequest / TreePlanRequest wrap { bundle, project } (project
  `#[serde(default)]` → a pre-M3 CLI still plans); the plan DTOs + `pic plan`
  gain an `ownership` row (mode-agnostic: shows in tsv + json).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/client.rs

@@ -1220,14 +1220,16 @@ impl Client {
         kind: NodeKind,
         slug: &str,
         bundle: &serde_json::Value,
+        project: Option<&crate::manifest::ManifestProject>,
     ) -> Result<PlanDto> {
         let slug = seg(slug);
+        let body = serde_json::json!({ "bundle": bundle, "project": project });
         let resp = self
             .request(
                 Method::POST,
                 &format!("/api/v1/admin/{}/{slug}/plan", kind.path()),
             )
-            .json(bundle)
+            .json(&body)
             .send()
             .await?;
         decode(resp).await
@@ -1274,10 +1276,15 @@ impl Client {
     }
 
     /// `POST /api/v1/admin/tree/plan` — diff a whole project tree (Phase 5).
-    pub async fn plan_tree(&self, bundle: &serde_json::Value) -> Result<TreePlanDto> {
+    pub async fn plan_tree(
+        &self,
+        bundle: &serde_json::Value,
+        project: Option<&crate::manifest::ManifestProject>,
+    ) -> Result<TreePlanDto> {
+        let body = serde_json::json!({ "bundle": bundle, "project": project });
         let resp = self
             .request(Method::POST, "/api/v1/admin/tree/plan")
-            .json(bundle)
+            .json(&body)
             .send()
             .await?;
         decode(resp).await
@@ -1527,6 +1534,9 @@ pub struct PlanDto {
     /// in `.picloud/` and replayed to `apply` for the bound-plan check.
     #[serde(default)]
     pub state_token: String,
+    /// §7 M3: the ownership outcome this apply would produce.
+    #[serde(default)]
+    pub ownership: Option<OwnershipPreviewDto>,
 }
 
 #[derive(Debug, Deserialize)]
@@ -1537,6 +1547,15 @@ pub struct ChangeDto {
     pub detail: Option<String>,
 }
 
+/// §7 M3 plan preview: `action` ∈ claim/owned/conflict/unclaimed; `owner` is
+/// the current owner's slug (for owned/conflict).
+#[derive(Debug, Deserialize)]
+pub struct OwnershipPreviewDto {
+    pub action: String,
+    #[serde(default)]
+    pub owner: Option<String>,
+}
+
 /// Response of `POST .../tree/plan` (Phase 5): a per-node diff + one combined
 /// bound-plan token for the whole subtree.
 #[derive(Debug, Deserialize)]
@@ -1567,6 +1586,9 @@ pub struct NodePlanDto {
     pub collections: Vec<ChangeDto>,
     #[serde(default)]
     pub suppressions: Vec<ChangeDto>,
+    /// §7 M3: this node's ownership outcome under the tree's `[project]`.
+    #[serde(default)]
+    pub ownership: Option<OwnershipPreviewDto>,
 }
 
 /// Response of `POST .../apply`: counts of what changed.