feat: deterministic stub orchestrator (v0.1.0)

The orchestrator-llm module turns a goal text into a Plan JSON
that the F∆I hub can apply. v0.1.0 is a deterministic stub —
it always emits a three-step plan (explain, explain-stub-notice,
save_flow with debug.echo) regardless of the goal.

Why ship a stub: it validates the module → plan → apply pipeline
end-to-end before adding LLM integration. The output is a
structurally valid Plan that round-trips cleanly through
fai_hub::plan::Plan deserialization.

v0.2.0 will replace the stub body with an actual LLM call once
the F∆I platform exposes outbound HTTP to permitted modules via
wasi-http.

Files:
- module.yaml — capability orchestrator.plan@0.1.0, no permissions
- wit/world.wit — copy of fai:platform@0.1.0
- src/lib.rs — wit_bindgen Guest impl that delegates to plan.rs
- src/plan.rs — pure plan-builder (host + WASM compatible)
- tests/plan_compatibility.rs — plan JSON shape assertions
- rust-toolchain.toml — pin to Rust 1.86 with wasm32-wasip2 target
- README.md — usage and status

Signed-off-by: flemming-it <sf@flemming.it>

wit/world.wit

@@ -0,0 +1,73 @@
+package fai:platform@0.1.0;
+
+/// Types that flow between the host (hub) and modules.
+interface types {
+  /// A typed value passed between the host and a module.
+  variant payload {
+    /// Plain UTF-8 text.
+    text(string),
+    /// Arbitrary JSON encoded as a string.
+    json(string),
+    /// Raw bytes with a MIME type.
+    bytes(bytes-value),
+    /// A reference to a file, by URI.
+    file-ref(file-ref),
+  }
+
+  /// Inline byte content.
+  record bytes-value {
+    mime-type: string,
+    data: list<u8>,
+  }
+
+  /// File reference by URI.
+  record file-ref {
+    uri: string,
+    mime-type: string,
+    size-bytes: u64,
+    sha256: string,
+  }
+
+  /// Context passed with every invocation.
+  record invocation-context {
+    invocation-id: string,
+    capability-namespace: string,
+    capability-name: string,
+    deadline-ms: u64,
+  }
+
+  /// Structured error type returned by modules.
+  variant invocation-error {
+    invalid-input(string),
+    permission-denied(string),
+    resource-exhausted(string),
+    deadline-exceeded,
+    internal(string),
+  }
+}
+
+/// The host-provided interface that modules can import to talk back.
+interface host {
+  /// Log a structured message. Level is "trace", "debug", "info", "warn", "error".
+  log: func(level: string, message: string);
+}
+
+/// The core interface every module exports.
+interface invoke {
+  use types.{payload, invocation-context, invocation-error};
+
+  /// Invoke the module with inputs, receive outputs or an error.
+  invoke: func(
+    ctx: invocation-context,
+    inputs: list<tuple<string, payload>>,
+  ) -> result<list<tuple<string, payload>>, invocation-error>;
+}
+
+/// The world a module component targets.
+///
+/// Modules `export` the invoke interface to be callable by the hub.
+/// Modules `import` the host interface to emit logs.
+world module {
+  import host;
+  export invoke;
+}