Implement cloud-planner-proxy: AI planner routes through Cloud API

Implements all 19 tasks of the cloud-planner-proxy OpenSpec change:

- Cloud API: cloud.planner_config (CloudPlannerConfig, load/build helpers)
  reusing runtime.tool_calling_client provider clients (no new dependency
  needed -- device-cloud-platform already depends on device-agent-runtime).
- Cloud API: new host-scoped POST /internal/v1/hosts/{host_id}/planner/decide
  internal endpoint, reusing existing bearer auth; logs only metadata
  (host id, tool name, latency, error class), never prompt/screenshot
  content.
- Host Agent: new AI_PLANNER_TRANSPORT config (direct default | cloud) and
  host_agent/cloud_planner_client.py::CloudProxyToolCallingClient, a
  synchronous ToolCallingClient implementation (structural, not importing
  runtime) that calls the new endpoint via its own httpx.Client -- avoids
  bridging the async HostAgentClient across the worker-thread boundary
  that AIPlanner.plan() runs in (asyncio.to_thread in lease.py).
- Host Agent wiring: create_execution_factories()/_host_agent_planner()
  select the cloud-proxy client only when AI_PLANNER_TRANSPORT=cloud;
  direct/unset transport is unchanged (still the default).
- Tests: 22 new tests across Cloud API config, the new endpoint, the new
  client, and transport-selection wiring; full non-integration suite
  (492 tests) passes with no regressions.
- Docs: docs/CLOUD_DEPLOYMENT.md documents the cloud transport, its
  trade-offs, and the credential split between Host Agent and Cloud API.

proposal.md/design.md were corrected during implementation to reflect two
findings: no new anthropic/openai dependency is actually needed, and
CloudProxyToolCallingClient uses its own sync httpx.Client rather than a
new HostAgentClient method, per the thread-boundary reasoning above.

apps/device-host-agent/tests/test_execution.py

@@ -5,6 +5,8 @@ from pathlib import Path
 import pytest
 
 from device.manager import DeviceManager
+from host_agent.cloud_planner_client import CloudProxyToolCallingClient
+from host_agent.config import HostAgentConfig
 from host_agent.execution import create_execution_factories
 from runtime.ai_planner import AIPlanner
 from runtime.planner import Planner
@@ -58,6 +60,54 @@ def test_created_task_runner_honors_explicit_ai_planner_opt_out(
     assert type(task_runner.planner) is Planner
 
 
+def test_cloud_transport_builds_ai_planner_with_cloud_proxy_client(
+    tmp_path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.delenv("AI_PLANNER_ENABLED", raising=False)
+    manager = DeviceManager()
+    host_agent_config = HostAgentConfig(
+        control_plane_url="https://control-plane.example",
+        host_id="host-a",
+        token="token-a",
+        ai_planner_transport="cloud",
+    )
+    factories = create_execution_factories(
+        manager,
+        workflow_store=WorkflowStore(tmp_path / "workflows.sqlite3"),
+        host_agent_config=host_agent_config,
+    )
+
+    task_runner = factories.task_runner_factory()
+
+    assert isinstance(task_runner.planner, AIPlanner)
+    assert isinstance(task_runner.planner.client, CloudProxyToolCallingClient)
+    assert task_runner.planner.client.config is host_agent_config
+
+
+@pytest.mark.parametrize("transport", [None, "direct"])
+def test_direct_transport_preserves_existing_local_provider_construction(
+    tmp_path, monkeypatch: pytest.MonkeyPatch, transport: str | None
+) -> None:
+    monkeypatch.delenv("AI_PLANNER_ENABLED", raising=False)
+    manager = DeviceManager()
+    host_agent_config = HostAgentConfig(
+        control_plane_url="https://control-plane.example",
+        host_id="host-a",
+        token="token-a",
+        **({} if transport is None else {"ai_planner_transport": transport}),
+    )
+    factories = create_execution_factories(
+        manager,
+        workflow_store=WorkflowStore(tmp_path / "workflows.sqlite3"),
+        host_agent_config=host_agent_config,
+    )
+
+    task_runner = factories.task_runner_factory()
+
+    assert isinstance(task_runner.planner, AIPlanner)
+    assert not isinstance(task_runner.planner.client, CloudProxyToolCallingClient)
+
+
 def test_runtime_owned_packages_do_not_import_host_or_cloud_concerns() -> None:
     root = Path(__file__).resolve().parents[3]
     forbidden = ("import cloud", "from cloud", "import host_agent", "from host_agent")