feat(voyage): add markdown-write.mjs + revision-guard.mjs + forward-compat policy comments — v4.2 Step 1

- lib/util/markdown-write.mjs: serializeFrontmatter (subset matches frontmatter.mjs parser), atomicWriteMarkdown (single tmp+rename, body bytes verbatim), readAndUpdate (read+mutate+write).
- lib/util/revision-guard.mjs: revisionGuard(path, mutator, validator) — backup -> mutate -> validate -> restore-on-fail. Extracted from /trekrevise prompt so rollback can be unit-tested.
- 12 tests for markdown-write, including 6-key source_annotations round-trip + walk-all-fixtures regression.
- 6 tests for revision-guard: applied/rolled-back/mutator-failed/sha256 stability/pre-existing-bak abort.
- Forward-compat policy comments in 3 validators (brief/plan/review) — non-functional pin against future strict-key refactors.

Pass: 508/510 (was 490; +18 net from v4.2 Step 1, 2 skipped Docker)

plugins/voyage/lib/validators/plan-validator.mjs

@@ -1,6 +1,13 @@
 // lib/validators/plan-validator.mjs
 // Wraps plan-schema (heading shape) + manifest-yaml (per-step Manifest blocks).
 // This is the JS equivalent of Phase 5.5 grep checks in planning-orchestrator.
+//
+// Schema is forward-compatible: unknown top-level frontmatter keys are
+// tolerated silently. Adding new optional fields (e.g. revision,
+// source_annotations, annotation_digest, revision_reason from v4.2) does
+// not require a plan_version bump (jf. source_findings precedent). Strict-key
+// checks are intentionally avoided so the /trekrevise revision-loop can
+// extend frontmatter without re-versioning.
 
 import { readFileSync, existsSync } from 'node:fs';
 import { sliceSteps, validatePlanHeadings, extractPlanVersion } from '../parsers/plan-schema.mjs';