Guarded idempotent Jira mutation plan and apply surface

[jeffhuber]

Part of #797. Depends on the Jira client and tracker contract issues.

Problem

Jira mutations must be useful for orchestration without turning a token with broad project permissions into an implicit autonomous writer.

Outcome

Add a plan-first, dry-run-default Jira mutation surface for claim, transition, comment, and remote-link operations.

Scope

• Require both configured writes_enabled: true and an explicit --apply for every mutation.
• Support only allow-listed claim/assignment, configured transition ids, bounded templated comments, and PR remote links.
• Do not support delete, attachment, arbitrary field update, project administration, or raw issue-body replacement.
• Validate the current issue state and available transition immediately before apply.
• Use stable idempotency markers/properties and bounded retry semantics so restarts cannot duplicate comments, links, or transitions.
• Separate owner decisions from agent authority and retain dry-run plans for audit.

Acceptance Criteria

• All writes are refused when either guard is absent.
• Permission, workflow drift, conflict, 429/5xx retry, timeout, and already-applied outcomes are explicit and non-destructive.
• Offline tests cover every mutation; no live Jira write occurs in CI or normal doctor.
• A documented live test remains owner-authorized and disposable.

CODE_MOWER_BUILDER:claude

[jeffhuber]

Claude lane - Dispatch for claude: implement issue #799 ("Guarded idempotent Jira mutation plan and apply surface") following docs/lanes/claude.md and docs/build-loop.md. Open exactly one PR, add builder:claude and audit labels: needs-codex-audit. Comment here with the PR link and head SHA when it is ready.