feat(apply): project on the plan wire + ownership preview annotation

§7 M3 (part 1): `pic plan` now surfaces the ownership outcome BEFORE apply.

- plan / plan_owner / plan_tree take the declaring `[project]`; each result
  carries an `ownership` preview (pure `preview_ownership`, unit-tested):
  claim (unclaimed + project), owned (already this project), conflict (owned by
  X — named), or unclaimed. A group node previews its OWN owner; an app node its
  nearest claimed ancestor (read-only, on the pool).
- the attach-point ceiling (M2) is now previewed at plan too, so `pic plan`
  outside the subtree fails early — consistent with apply.
- wire: PlanRequest / TreePlanRequest wrap { bundle, project } (project
  `#[serde(default)]` → a pre-M3 CLI still plans); the plan DTOs + `pic plan`
  gain an `ownership` row (mode-agnostic: shows in tsv + json).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/cmds/plan.rs

@@ -31,7 +31,9 @@ pub async fn run(manifest_path: &Path, env: Option<&str>, mode: OutputMode) -> R
         NodeKind::App
     };
 
-    let plan = client.plan_node(kind, manifest.slug(), &bundle).await?;
+    let plan = client
+        .plan_node(kind, manifest.slug(), &bundle, manifest.project.as_ref())
+        .await?;
     // Record the bound-plan token so a subsequent `pic apply` can detect the
     // node changing underneath the reviewed plan (best-effort — a read-only
     // plan still succeeds if the project dir isn't writable).
@@ -49,8 +51,8 @@ pub async fn run(manifest_path: &Path, env: Option<&str>, mode: OutputMode) -> R
 pub async fn run_tree(dir: &Path, env: Option<&str>, mode: OutputMode) -> Result<()> {
     let creds = config::resolve()?;
     let client = Client::from_creds(&creds)?;
-    let (bundle, _count, _project) = crate::discover::build_tree(dir, env)?;
-    let plan = client.plan_tree(&bundle).await?;
+    let (bundle, _count, project) = crate::discover::build_tree(dir, env)?;
+    let plan = client.plan_tree(&bundle, project.as_ref()).await?;
     if !plan.state_token.is_empty() {
         if let Err(e) = crate::linkstate::write_plan(dir, TREE_TOKEN_KEY, &plan.state_token) {
             eprintln!("warning: could not record plan state for `pic apply`: {e}");
@@ -64,6 +66,15 @@ fn render_tree(plan: &TreePlanDto, mode: OutputMode) {
     let mut table = Table::new(["node", "kind", "op", "resource", "detail"]);
     for n in &plan.nodes {
         let node = format!("{}:{}", n.kind, n.slug);
+        if let Some(o) = &n.ownership {
+            table.row([
+                node.clone(),
+                "ownership".to_string(),
+                o.action.clone(),
+                o.owner.clone().unwrap_or_default(),
+                String::new(),
+            ]);
+        }
         let groups: [(&str, &Vec<ChangeDto>); 8] = [
             ("script", &n.scripts),
             ("route", &n.routes),
@@ -185,6 +196,14 @@ fn tagged(kind: &str, spec: impl Serialize) -> Result<Value> {
 
 fn render(plan: &PlanDto, mode: OutputMode) {
     let mut table = Table::new(["kind", "op", "resource", "detail"]);
+    if let Some(o) = &plan.ownership {
+        table.row([
+            "ownership".to_string(),
+            o.action.clone(),
+            o.owner.clone().unwrap_or_default(),
+            String::new(),
+        ]);
+    }
     let groups: [(&str, &Vec<ChangeDto>); 8] = [
         ("script", &plan.scripts),
         ("route", &plan.routes),