fix(ultraplan-local): Bug 3 — wire frontmatter consistency check into /ultracontinue Phase 1.5

Step 8 of v3.4.1 plan.

commands/ultracontinue-local.md:
- New Phase 1.5 between Phase 1 and Phase 2 — runs the
  next-session-prompt-validator in --consistency mode when both candidates
  exist (plugin-root + project-dir). Refuses on producer mismatch with
  fresh candidates, downgrades stale candidate to a warning, downgrades
  >24h wall-clock drift to a soft warning.
- Anti-substitution rule applies — paths emitted as concrete tokens, not
  template placeholders.

lib/validators/next-session-prompt-validator.mjs:
- Sharpen NEXT_SESSION_PROMPT_PRODUCER_MISMATCH error message to include
  the literal "produced_by" field name so consumers (and operators) can
  trace the disagreement back to the YAML key.

tests/commands/ultracontinue.test.mjs:
- Test (Bug 3 prose) — Phase 1.5 header present, references validator,
  appears between Phase 1 and Phase 2 in document order.
- Test (Bug 3 e) — tmp project dir with state file + two prompt files
  with mismatched producers, both fresh relative to state.updated_at;
  CLI consistency mode exits non-zero, JSON stdout surfaces
  NEXT_SESSION_PROMPT_PRODUCER_MISMATCH with both paths and the
  "produced_by" token in the message.

Tests 346 -> 348 (+2).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

plugins/ultraplan-local/commands/ultracontinue-local.md

@@ -117,6 +117,55 @@ resumable state wins.
   with that path. (Operators who want a different candidate re-invoke as
   `/ultracontinue <project-dir>`.)
 
+## Phase 1.5 — Frontmatter consistency check
+
+Bug 3 contract: producers (`/ultraexecute-local`, `/ultraplan-end-session-local`)
+write `NEXT-SESSION-PROMPT.local.md` with YAML frontmatter (`produced_by:`,
+`produced_at:`). Multiple producers may have written candidates in different
+locations; this phase refuses ambiguity before validating the state file.
+
+After resolving the project directory and state-file path, look for two
+`NEXT-SESSION-PROMPT.local.md` candidates:
+
+  a. `<plugin-root>/NEXT-SESSION-PROMPT.local.md` — operator-managed master file
+  b. `<project-dir>/NEXT-SESSION-PROMPT.local.md` — producer-written sibling
+
+**If both exist:**
+
+- Read both via the **Read tool** (NOT Bash — same anti-substitution rule
+  as Phase 2).
+- Invoke the consistency validator with both paths emitted as concrete
+  literal tokens (no template substitution at the Bash boundary):
+
+  ```
+  node lib/validators/next-session-prompt-validator.mjs --json --consistency <RESOLVED-PATH-A> <RESOLVED-PATH-B>
+  ```
+
+  Replace `<RESOLVED-PATH-A>` and `<RESOLVED-PATH-B>` with the two concrete
+  filesystem paths you have in your working context. The validator emits
+  `{valid, errors, warnings}` JSON on stdout.
+
+- **If `valid: false`** (typically `NEXT_SESSION_PROMPT_PRODUCER_MISMATCH`):
+  print the structured `errors[]` (each `[code] message` on its own line),
+  list both candidate paths, and exit non-zero. Do NOT proceed to Phase 2.
+  Resolve the conflict by deleting the stale candidate (run
+  `/ultracontinue-local --cleanup --confirm <project-dir>` after the
+  current session closes, or remove by hand).
+
+- **If `valid: true` with a `NEXT_SESSION_PROMPT_WALL_CLOCK_DRIFT` warning**
+  (one of the candidates is more than 24h old): print the warning to stderr
+  but continue — long pauses (weekend, vacation) are not failures.
+
+- **If `valid: true` with a `NEXT_SESSION_PROMPT_STALE_IGNORED` warning**
+  (one candidate is older than the state file's `updated_at`): print the
+  warning and continue. The state-anchored check is the primary refusal
+  signal; staleness simply rejects the older candidate.
+
+**If only one exists:** continue to Phase 2. No comparison needed.
+
+**If neither exists:** continue to Phase 2. Legacy projects and first-run
+flows have no NEXT-SESSION-PROMPT files.
+
 ## Phase 2 — Validate the state file
 
 Phase 1 resolved a concrete state-file path. That path is a real string in