Default-enable AI Planner in Host Agent; propose cloud-planner-proxy

- Host Agent now defaults AI_PLANNER_ENABLED=true (opt-out via env),
  scoped to apps/device-host-agent/host_agent/execution.py only; the
  shared runtime.planner_config default (disabled) is unchanged.
- Add openspec proposal for cloud-planner-proxy: centralize LLM
  provider config/credentials on the Cloud Control Plane and let the
  Host Agent proxy AI Planner decisions through it instead of holding
  provider API keys locally. Proposal only, no implementation yet.

apps/device-host-agent/tests/test_execution.py

@@ -2,8 +2,12 @@ from __future__ import annotations
 
 from pathlib import Path
 
+import pytest
+
 from device.manager import DeviceManager
 from host_agent.execution import create_execution_factories
+from runtime.ai_planner import AIPlanner
+from runtime.planner import Planner
 from runtime.task import TaskRunner
 from workflow.runner import WorkflowRunner
 from workflow.store import WorkflowStore
@@ -26,6 +30,34 @@ def test_execution_factories_compose_existing_runtime_and_workflow(tmp_path) ->
     assert isinstance(workflow_runner.task_runner_factory(), TaskRunner)
 
 
+def test_created_task_runner_defaults_to_ai_planner(
+    tmp_path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.delenv("AI_PLANNER_ENABLED", raising=False)
+    manager = DeviceManager()
+    factories = create_execution_factories(
+        manager, workflow_store=WorkflowStore(tmp_path / "workflows.sqlite3")
+    )
+
+    task_runner = factories.task_runner_factory()
+
+    assert isinstance(task_runner.planner, AIPlanner)
+
+
+def test_created_task_runner_honors_explicit_ai_planner_opt_out(
+    tmp_path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.setenv("AI_PLANNER_ENABLED", "false")
+    manager = DeviceManager()
+    factories = create_execution_factories(
+        manager, workflow_store=WorkflowStore(tmp_path / "workflows.sqlite3")
+    )
+
+    task_runner = factories.task_runner_factory()
+
+    assert type(task_runner.planner) is Planner
+
+
 def test_runtime_owned_packages_do_not_import_host_or_cloud_concerns() -> None:
     root = Path(__file__).resolve().parents[3]
     forbidden = ("import cloud", "from cloud", "import host_agent", "from host_agent")