feat(ultraplan-local): add --gates autonomy-control flag to all four pipeline commands

Single autonomy-control surface (--gates) added to ultrabrief, ultraresearch,
ultraplan, and ultraexecute. When present, sets gates_mode = true and
re-enables approval pauses at every phase boundary + every wave for
high-stakes runs. When absent (default in auto), the chain runs continuously
to the main-merge gate (which always pauses regardless of --gates — that
boundary is the one always-on safety stop).

ultrabrief:    pause after auto-mode confirmation; emit brief-approved event
ultraresearch: pause after each topic completes
ultraplan:     pause after Phases 5, 7, 9
ultraexecute:  pause after each wave's worktrees finish, before merge-back,
               AND before the main-merge gate (MAIN_MERGE_GATE)

All four commands invoke the autonomy-gate state machine via the CLI shim
node lib/util/autonomy-gate.mjs (built in S8). Test pin in
tests/lib/gates-flag-coverage.test.mjs locks the contract.

Also wires the brief-approved stats emission into ultrabrief Phase 5 auto
path (was the SC4 wiring requirement from plan-v2 Step 11).

plugins/ultraplan-local/commands/ultraplan-local.md

@@ -107,7 +107,14 @@ Parse `$ARGUMENTS` for mode flags. Order of precedence:
 7. **`--quick`** — set **mode = quick**. Skip agent swarm; use lightweight
    Glob/Grep scan and go directly to planning + adversarial review.
 
-8. If neither `--brief` nor `--project` is present after flag parsing,
+8. **`--gates`** — autonomy control. When present, set `gates_mode = true`.
+   Pause for operator confirmation after Phase 5 (exploration), Phase 7
+   (synthesis), and Phase 9 (adversarial review). Default `gates_mode =
+   false` lets phases flow continuously. The flag is consumed by the
+   autonomy-gate state machine via the CLI shim:
+   `node ${CLAUDE_PLUGIN_ROOT}/lib/util/autonomy-gate.mjs --state X --event Y --gates {true|false}`.
+
+9. If neither `--brief` nor `--project` is present after flag parsing,
    output usage and stop:
 
 ```