fix: warn when a parallel session overwrites plan progress (#217)

Two sessions sharing one plan directory can both write task_plan.md from
the same read. The later write silently discards the earlier one's work,
and nothing notices: injection, plan-doctor and the Stop gate all read
the clobbered file as an ordinary edit.

Attestation does not cover this. It compares against a baseline a human
approved once, it reports a collaborator's edit with the same
[PLAN TAMPERED] wording as a hostile rewrite, and it is a read-side gate
that cannot stop the stale write from landing.

Comparing the raw hash against what the hooks last saw would flag a
single agent's own edit on its very next fire, which is most fires. This
compares progress instead: checked items and completed phases only go up
during normal work, so a decrease means work that was on disk is gone.
Forward motion stays silent, which is what keeps the signal worth
reading. Both markers are language-neutral, because every translated
template deliberately keeps the literal English "**Status:** complete"
token that check-complete.sh matches with grep -F.

On by default in every mode, and that is deliberate rather than an
oversight of the legacy byte-identical-output invariant. Arming it only
in a v3 mode would arm it exactly where it is redundant: a v3 mode
refuses to inject an unattested plan at all, and an attested one already
reports an outside edit as TAMPERED. The unprotected population is
legacy, which is also the default. PWF_PLAN_GUARD=0 or a plan-guard-off
token in .mode restores the old silence.

The marker lives in its own pwf-prog cache directory rather than
pwf-sha, because test_pinned_plan_shares_one_cache_slot_across_cwds
asserts one slot per plan there to catch the per-cwd-key bug from #212.
The key derivation is deliberately identical, so the marker inherits the
same cwd-invariance.

Advisory only: this hook contracts to always exit 0 and no supported
host offers a PreToolUse deny path.