chore(steward): upgrade to plan-marshall 0.1.1670 (#303)

## Summary

Changes from a `/marshall-steward upgrade` run against plan-marshall
0.1.1670.

- `.plan/marshal.json`: provisioning stamps re-stamped
(`provisioned_version` 0.1.1617 → 0.1.1670, new
`config_seed_fingerprint`). `sync-defaults` added no keys; finalize
steps were already ordered.
- `CLAUDE.md`: explains that the `Edit(.plan/**)` permission covers
every file-editing tool, including Write.

## Notes

- `build.map` was intentionally **not** re-seeded. The drift report
listed only the four hand-added gate globs (`*.css`, `*.ts`,
`Dockerfile*`, `docker-compose*.yml`). Re-seeding would delete them and
break `BuildGateCoverageContractTest`.
- The `general-dev` skill domain is already `always_on: true`, so
nothing changed there.
- Reviewer config validated clean: 3 tokens checked (coderabbit,
cuioss-review-bot, sourcery).
- The footprint has no build inputs, so the Maven gate does not apply.

Co-authored-by: Oliver Wolff <23139298+cuioss@users.noreply.github.com>
Co-authored-by: plan-marshall <noreply@cuioss.de>

Author: cuioss-oliver

.plan/marshal.json

@@ -382,7 +382,7 @@
       "no_plan_body_days": 7,
       "build_results_days": 5
     },
-    "provisioned_version": "0.1.1617",
-    "config_seed_fingerprint": "cf572469"
+    "provisioned_version": "0.1.1670",
+    "config_seed_fingerprint": "d6385af3"
   }
 }

CLAUDE.md

@@ -233,7 +233,7 @@ All cuioss repositories have branch protection on `main`. Direct pushes to `main
 
 ## Temporary Files
 
-Use `.plan/temp/` for ALL temporary and generated files (covered by `Write(.plan/**)` permission — avoids permission prompts).
+Use `.plan/temp/` for ALL temporary and generated files (covered by the `Edit(.plan/**)` permission, which applies to every file-editing tool including Write — avoids permission prompts).
 
 ## Tool Usage