feat: writes via chat — Reginald proposes, you approve inline (P4)

Completes "chat is the write-path" (decisions.md D1). Ask Reginald to re-estimate
or reprioritize an issue; it formulates a proposal, you approve it inline, and the
write runs through the same guarded apply_changes engine the Issue screen uses.
The model never writes — it proposes; the app owns approval + execution.

core (@commitea/core):
- propose_change tool declaration + REGINALD_SYSTEM updated ("never claim a change
  is applied; you propose, the human approves").
- proposalsFor(args, currentLabels, title): pure — builds the concrete, non-noop
  ChangeProposal(s) (change + label diff) for a propose_change request, dropping
  invalid/unchanged axes. ChangeProposal / ProposeChangeArgs types.

app:
- model bridge executes propose_change by planning against the issue's current
  labels (no write) and returns the proposals with the turn.
- useChat surfaces pending proposals + approve/dismiss; approve calls onApplyChange
  (AppShell's guarded handler → PUT + board/forecast refetch), dismiss leaves it.
- ChatPanel renders each proposal as a propose-approve card (diff + Approve/Dismiss).

Verified: 101 core tests green (4 proposalsFor added), desktop typecheck clean,
14 fixture e2e green. Gated live e2e against gemma-4-26b: "Set the estimate on #3
to est/5d" → Reginald proposes "est/2d → est/5d" as an inline card, says it's
*proposed* not done; Dismiss leaves the repo untouched. The approve→write path is
the #41 engine (separately verified change→revert).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/desktop/src/main/model.ts

@@ -9,10 +9,14 @@
 
 import {
   buildProjectView,
+  type ChangeProposal,
   type ChatMessage,
   createChatClient,
+  describeChange,
   type ModelRouter,
   type ProjectView,
+  proposalsFor,
+  type ProposeChangeArgs,
   type QueryFilters,
   REGINALD_SYSTEM,
   REGINALD_TOOLS,
@@ -80,12 +84,28 @@ export function registerModelIpc(): void {
     const model = await resolveLoadedModel(router.small.baseUrl, router.small.model)
     const chat = createChatClient({ ...router.small, model }, fetch)
 
+    // Proposals the model formulates this turn; the renderer approves them (the
+    // write happens through gitea:applyChange, never inside the loop).
+    const proposals: ChangeProposal[] = []
+
     const execute = async (name: string, args: unknown) => {
-      if (name !== 'query_project') return { error: `unknown tool: ${name}` }
       if (!client) return { error: 'gitea is not configured' }
-      const snap = await reconcileSnapshot(client)
-      const a = (args ?? {}) as { view: ProjectView; filters?: QueryFilters }
-      return buildProjectView(a.view, a.filters, snap, new Date())
+      if (name === 'query_project') {
+        const snap = await reconcileSnapshot(client)
+        const a = (args ?? {}) as { view: ProjectView; filters?: QueryFilters }
+        return buildProjectView(a.view, a.filters, snap, new Date())
+      }
+      if (name === 'propose_change') {
+        const a = (args ?? {}) as ProposeChangeArgs
+        const issue = await client.getIssue(a.issue).catch(() => null)
+        if (!issue) return { error: `issue #${a.issue} not found` }
+        const built = proposalsFor(a, issue.labels, issue.title)
+        proposals.push(...built)
+        return built.length
+          ? { proposed: built.map((p) => ({ issue: a.issue, diff: describeChange(p.plan) })) }
+          : { proposed: [], note: 'no change — already at that value' }
+      }
+      return { error: `unknown tool: ${name}` }
     }
 
     try {
@@ -95,7 +115,7 @@ export function registerModelIpc(): void {
         tools: REGINALD_TOOLS,
         execute,
       })
-      return { ok: true as const, content: turn.content, steps: turn.steps }
+      return { ok: true as const, content: turn.content, steps: turn.steps, proposals }
     } catch (e) {
       return { ok: false as const, reason: 'error' as const, message: e instanceof Error ? e.message : String(e) }
     }