Default-enable AI Planner in Host Agent; propose cloud-planner-proxy

- Host Agent now defaults AI_PLANNER_ENABLED=true (opt-out via env),
  scoped to apps/device-host-agent/host_agent/execution.py only; the
  shared runtime.planner_config default (disabled) is unchanged.
- Add openspec proposal for cloud-planner-proxy: centralize LLM
  provider config/credentials on the Cloud Control Plane and let the
  Host Agent proxy AI Planner decisions through it instead of holding
  provider API keys locally. Proposal only, no implementation yet.

docs/CLOUD_DEPLOYMENT.md

@@ -346,18 +346,24 @@ back to the upstream.
 
 ## Runtime AI Planner
 
-The Host Agent reuses the local Runtime planner. AI planning is disabled by
-default. Configure it in the Host Agent environment when goal assignments must
-use a model:
+The Host Agent reuses the local Runtime planner. Unlike the shared Runtime
+library (whose own default is the deterministic stub planner), the **Host
+Agent defaults `AI_PLANNER_ENABLED` to on** -- it is the actual device-control
+path, so goal assignments use a model unless an operator explicitly opts out.
+Provide provider credentials before deploying:
 
 ```text
-AI_PLANNER_ENABLED=true
 AI_PLANNER_PROVIDER=anthropic
 AI_PLANNER_MODEL=claude-sonnet-5
 AI_PLANNER_TIMEOUT_SECONDS=30
 ANTHROPIC_API_KEY=<secret manager reference>
 ```
 
+Without a valid API key, every planning step raises immediately and the task
+fails on its first step (no silent fallback to the stub planner). Set
+`AI_PLANNER_ENABLED=false` to opt back out to the deterministic stub planner
+(e.g. for offline/dev hosts with no provider credentials).
+
 For OpenAI, set `AI_PLANNER_PROVIDER=openai`, choose the deployed model through
 `AI_PLANNER_MODEL`, and provide `OPENAI_API_KEY`. Provider credentials belong
 only on the Host Agent; the Cloud API does not need them.