feat(planning): interview surface registry with the one-line default-and-alternatives offer #12658

resolveMedium(request) -> Resolution
request:    lane, argument?, userConfig?, projectRoot?, teamRef?
Resolution: preferred?, medium, decidedBy, notices[]
Rules: the argument decides alone. Each scope's own value is read separately (cascade file reader
and schema check, not resolve()'s merged output; team file optionally from teamRef). terminal/file
from any scope keeps the view local. Else the first publishing value from a trusted scope wins:
personal override (untracked and gitignored only), then userConfig. With no scope deciding, the
plugin default applies (trusted: the installed plugin); "any scope" never includes the plugin default. A team file never publishes; an invalid value is ignored without dropping another
scope's value; auto equals unset. Retired files (~/.claude/rendered-views.md,
.claude/rendered-views*.md) produce notices, never values.
CLI: view-settings resolve --lane <id> --option <user_config.medium> [--argument <m>] [--team-ref <ref>]

MediumEntry   { id, publishes, reachable(context) -> {ok, reason}, deliver(view, context) -> {location}, reportName }
SurfaceEntry  { id (terminal | page | shared-session; a shared-session variant is a new entry),
                available(context) -> {ok, reason}, start(session) -> handle, reportName }
ViewKindEntry { id, parse(record) -> data, template, tier }
Lane registration: { laneId, kinds[], hostedCapable }
Fallback chain (medium registry): artifact, file, terminal; hosted read as artifact unless hostedCapable.
Skills call resolveMedium, render(laneId, kind, record), resolveSurface; they never name a medium,
surface or kind value in their own prose.

Report line: view: <medium> (<decidedBy>), plus one line per notice.

PageInput { kind: lock | unlock | comment, recordId, choiceId?, optionId?, text?, at }
- untrusted data; the session reads only these fields; a lock is written to the record, never approval
- delivery: file via the session bridge; terminal via the conversation; Artifact via a
  "Copy choices as prompt" control (existing runtime copy binding) the owner pastes; the page says
  live lock needs the local page
- unhandled input is collected at the start of the owner's next message

Redraw binding: a choice names the example blocks it selects; client-only, no network, no storage.