feat(planner): add reachability_check step (#1606)

* feat(planner): add reachability_check step to prevent unreachable code

Closes #1495

* fix: trim gsd-planner.md below 50000-char limit after rebase

The reachability_check addition pushed the file to 50,275 chars when
merged with the assign_waves additions from #1600. Condense both sections
while preserving all logic; file is now 49,859 chars.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(security): normalize CRLF before prompt-stuffing length check

On Windows, git checks out files with CRLF line endings. JavaScript's
String.length counts \r characters, so a 49,859-byte file measures as
51,126 chars on Windows — falsely tripping the 50,000-char security
scanner. Normalize CRLF → LF before measuring in security.cjs and in
the reachability-check test.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: trim gsd-planner.md to stay under 50000-char limit after merge with main

After rebasing onto main (which added mcp_tool_usage block), combined content
reached 50031 chars. Remove suggested log format from assign_waves rule to
bring file to 49972 chars, well under the 50000-char security scanner limit.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

agents/gsd-planner.md

@@ -1232,11 +1232,7 @@ for each plan B in plan_order:
       waves[B.id] = B.wave
 ```
 
-**Rule:** Any two plans in the same wave MUST have zero `files_modified` overlap — even if
-no explicit `depends_on` was set. After computing all wave numbers, verify every wave group:
-collect the union of `files_modified` per wave; if any file appears in two or more plans
-within the same wave, bump the later plan to the next wave and repeat until clean.
-Log each bump: `"Plan {B} moved to wave {N+1}: files_modified overlap with Plan {A} on {file}"`
+**Rule:** Same-wave plans must have zero `files_modified` overlap. After assigning waves, scan each wave; if any file appears in 2+ plans, bump the later plan to the next wave and repeat.
 </step>
 
 <step name="group_into_plans">
@@ -1256,6 +1252,15 @@ Apply goal-backward methodology (see goal_backward section):
 5. Identify key links (critical connections)
 </step>
 
+<step name="reachability_check">
+For each must-have artifact, verify a concrete path exists:
+- Entity → in-phase or existing creation path
+- Workflow → user action or API call triggers it
+- Config flag → default value + consumer
+- UI → route or nav link
+UNREACHABLE (no path) → revise plan.
+</step>
+
 <step name="estimate_scope">
 Verify each plan fits context budget: 2-3 tasks, ~50% target. Split if necessary. Check granularity setting.
 </step>