Default-enable AI Planner in Host Agent; propose cloud-planner-proxy

- Host Agent now defaults AI_PLANNER_ENABLED=true (opt-out via env),
  scoped to apps/device-host-agent/host_agent/execution.py only; the
  shared runtime.planner_config default (disabled) is unchanged.
- Add openspec proposal for cloud-planner-proxy: centralize LLM
  provider config/credentials on the Cloud Control Plane and let the
  Host Agent proxy AI Planner decisions through it instead of holding
  provider API keys locally. Proposal only, no implementation yet.

apps/device-host-agent/host_agent/execution.py

@@ -1,10 +1,12 @@
 from __future__ import annotations
 
+import os
 from collections.abc import Callable
-from dataclasses import dataclass
+from dataclasses import dataclass, replace
 
 from device.manager import DeviceManager
 from runtime.executor import Executor, default_tool_registry
+from runtime.planner_config import PlannerConfig, load_config as load_planner_config
 from runtime.task import TaskRunner
 from storage.task_metadata import TaskMetadataStore
 from storage.timeline import Timeline
@@ -33,6 +35,7 @@ def create_execution_factories(
             executor=Executor(tools=default_tool_registry(manager=manager)),
             metadata_store=metadata_store,
             timeline=timeline,
+            planner_config=_host_agent_planner_config(),
         )
 
     def create_workflow_runner() -> WorkflowRunner:
@@ -46,3 +49,18 @@ def create_execution_factories(
         workflow_runner_factory=create_workflow_runner,
         workflow_store=shared_workflow_store,
     )
+
+
+def _host_agent_planner_config() -> PlannerConfig:
+    """Host Agent defaults to the AI planner unless an operator opts out.
+
+    `runtime.planner_config` defaults `enabled=False` for the shared Runtime
+    library (local dev/tests/cloud dispatcher keep the deterministic stub
+    planner unless asked). The Host Agent is the actual device-control path,
+    so it flips that default on here -- an explicit `AI_PLANNER_ENABLED=false`
+    still disables it.
+    """
+    config = load_planner_config()
+    if os.environ.get("AI_PLANNER_ENABLED") is None:
+        config = replace(config, enabled=True)
+    return config