chore: planner run 2026-04-17

- Updated prerequisite tree: Nomad+Vault orchestration (Steps 0–4) DONE
- #425 closed, #758 HUMAN_BLOCKED (ops repo branch protection)
- Created vault/pending/disinto-ops-branch-protection.md
- Created vault lifecycle directories (pending/, approved/, fired/, rejected/)
- Closed #947 (already fixed by #948)
- Graph: 224 nodes, 251 edges, healthy

vault/pending/disinto-ops-branch-protection.md

@@ -0,0 +1,24 @@
+# Request: Remove or relax ops repo branch protection
+
+## What
+The `disinto-ops` repo has branch protection on `main` that requires approvals, but no bot account has merge permissions. All agent writes (prerequisites.md, planner-memory.md, vault items, evidence) have been accumulating locally only since planner run 2 (2026-04-08).
+
+## Why
+Blocks #758, which blocks #820 (re-seed ops dirs), which blocks the vault lifecycle workflow, evidence collection, and planner remote persistence. The ops repo remote `main` has been frozen for 9 days.
+
+## Human action
+1. Go to Forgejo admin: disinto-ops repo → Settings → Branches → Branch protection for `main`
+2. Either:
+   a. Add `planner-bot` to the push/merge allowlist, OR
+   b. Remove branch protection from `disinto-ops` entirely (ops repo is internal, not public-facing)
+3. Verify: `planner-bot` can push to `origin/main` on `disinto-ops`
+
+## Factory will then
+- Close #758 (ops repo branch protection)
+- Execute #820 (re-seed ops dirs: vault/pending, vault/approved, vault/fired, vault/rejected, evidence/*, portfolio.md, RESOURCES.md)
+- Resume remote persistence of prerequisites.md and planner-memory.md
+- Unblock vault lifecycle workflow (pending → approved → fired)
+
+## Unblocks
+- #758 — bug: ops repo branch protection blocks all agent writes
+- #820 — fix: re-seed ops repo directories after branch protection resolved