phase10: formulate manifest — cloud preplanner / local executor split

Resolves direction for #89. Splits Norris into two roles:

- Preplanner (cloud) fires ONCE at :norris launch; emits TASK: list.
- Executor (local) handles each TASK; existing HALT protocol intact.

ctx.norris_tasks anchor survives eviction (mirrors ctx.norris_goal).
Cost category 'norris-preplan' separates the cloud preplan call
from per-step executor cost in :cost detail.

Graceful fall-back when cfg.norris.preplanner is unset OR preplan
call fails — Norris runs as today (single-model). No regression for
existing users.

PHASE0 §11 amended to add Phase 10 row.

Manifest declares 6 Open Questions for analyze step; 12 design
decisions table; module-touch table; 4-pillar plan.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/PHASE0.md

@@ -325,6 +325,7 @@ from somewhere else.
 | **7** | Cost / usage observability: broker captures `usage` + `cost`; per-session accumulator on ctx; `:cost` reporter; optional warn thresholds |
 | **8** | Accurate tokenization: per-endpoint `/tokenize` probe (cached); `broker.token_count`; `Context:estimate_tokens` widened; `:cost detail` est-vs-actual annotation |
 | **9** | Project-local config overlay (`.aish.lua` walk-up from cwd to $HOME, sha256-pinned trust prompt, shallow merge over user config); `:config show` meta |
+| **10** | Cloud preplanner + local executor split for Norris (`cfg.norris.preplanner` emits TASK list once; `cfg.norris.executor` runs each step); `extract_task_lines`; `ctx.norris_tasks` anchor (survives eviction); cost category `"norris-preplan"` |
 
 ---