feat: certify chat operator turns through loop-run

packages/casan-control-panel/README.md

@@ -56,12 +56,12 @@ Approval inbox / HITL:
 - `POST /api/v1/approvals/decide` — approve/reject with SoD and reason; approved
   settings proposals apply through `control-plane-settings.py`.
 
-Governed Chat (Plan-18 MVP-0/1 + MVP-2 Track 4 foundation):
+Governed Chat (Plan-18 MVP-0/1 + MVP-2 Track 4 and Operator Track 5/6):
 
 - `POST /api/v1/chat/ask` — Ask CASAN endpoint. The API only wraps harness
   `chat-turn.py`; router verdicts, H4 input/output scan, action-gate decisions,
-  H5 chat audit, H6 token metrics, evidence source selection, and operator action
-  execution remain harness-owned.
+  Plan-17 loop-run certification, H5 chat audit, H6 token metrics, evidence source
+  selection, and operator action execution remain harness-owned.
 - `GET /api/v1/chat/actions` — list registered operator actions from
   `operator-actions.yaml`; no free-command execution is exposed.
 - `GET /api/v1/chat/agents` — list governed agents from `agent-registry.yaml`
@@ -69,9 +69,10 @@ Governed Chat (Plan-18 MVP-0/1 + MVP-2 Track 4 foundation):
   `chat-agent-resolver.py`.
 - `GET /api/v1/chat/audit/verify` — verifies the chat audit hash chain.
 - `/chat` UI shows actor/role scope, `mode/risk/decision` badges, certified answer,
-  evidence sources, registered operator actions, agent binding, action-gate status,
-  router details, and audit hash. Side-effect requests outside registered actions
-  return governed `BLOCK` or `NOT_SUPPORTED` responses.
+  evidence sources, registered operator actions, agent binding, loop certification,
+  action-gate status, router details, and audit hash. Side-effect requests outside
+  registered actions return governed `BLOCK` or `NOT_SUPPORTED` responses; operator
+  side effects are held until the loop draft is certified.
 
 FinOps/SLO: