Name planning sessions by project name instead of id

[MJohnson459]

Planning sessions are now named for their project rather than its id: voro-plan-mote with prompt/log stem plan-mote, instead of voro-plan-2/plan-2. The bare number in a Voro-composed session name is now always a task id.

What changed

• Launch::Plan (crates/voro-core/src/agent.rs) carries project: String instead of project_id: i64; session_name() and slug() render the name. Its construction site, plan_session's PlanTarget::Create arm in crates/voro/src/dispatch.rs, already loads the project row, so it just passes project.name.
• Both accessors run the name through a new private sanitize_for_name in voro-core, next to Launch, replacing every character outside [A-Za-z0-9._-] with - and preserving case (voro-plan-ODM). The name is substituted into a shell command line and the slug becomes a filename, so it lives with the type rather than at each construction site. Project names are UNIQUE NOT NULL, so name-keyed sessions cannot collide; two names that reduce to the same string is a deliberate non-case.
• Carrying a String drops Copy from Launch and LaunchSpec; the one site that partially moved out of its Expansion (spawn_expansion) clones instead. Dispatch and refine naming (voro-<id>, voro-<id>-refine) is untouched. No migration: session names already recorded stay as recorded.
• Docs: docs/agent-integration.md's session-naming contract now states voro-plan-<project> with the sanitizing rule; the naming-invariant paragraph in docs/DESIGN.md §8, which already said voro-plan-<project>, is now literally true and says why the id was wrong there.

Verification

• New a_planning_session_sanitizes_its_project_name unit test covers spaces, quotes, shell metacharacters, a slash, capitals, and the characters that pass through untouched.
• Existing Launch tests in agent.rs and the plan-session tests in dispatch.rs updated; plan_session_assembles_the_launch_and_writes_the_prompt now asserts the prompt file is stemmed plan-proj-, so the project's name reaching the launch is checked end to end.
• cargo test --workspace (614 tests) and cargo clippy --workspace --all-targets -- -D warnings both pass; cargo fmt --all clean.