docs(16): create phase plan

.planning/ROADMAP.md

@@ -325,13 +325,16 @@ Plans:
 **Boundary:** Extends the existing Gitea CI workflow + publish job; does not remove dev-bypass (still needed for local verification and the Phase 7/8 harness) and does not add a new external service or a runtime dependency to the app. Automated dependency *upgrades* (e.g. Renovate/Dependabot bots) are a separate concern — decide in discuss whether they're in scope or deferred.
 
 **Plans**: 6 plans in 2 waves
-
 Plans:
+**Wave 1**
 
 - [ ] 16-01-PLAN.md — Image-hygiene runtime: bake NODE_ENV=production + boot-time refuse-to-boot guard (IMG-01)
 - [ ] 16-02-PLAN.md — pnpm audit gate + waiver allowlist + advisory-only tiered outdated report (DEP-01, DEP-02)
 - [ ] 16-03-PLAN.md — Fold eslint-plugin-security into the lint gate as blocking errors + triage (SEC-02)
 - [ ] 16-04-PLAN.md — gitleaks config + full-history baseline + .dockerignore (SEC-01, IMG-02)
+
+**Wave 2** *(blocked on Wave 1 completion)*
+
 - [ ] 16-05-PLAN.md — Add the security job to ci.yml (gitleaks always; audit/outdated code-gated) + gate wiring (CI-03)
 - [ ] 16-06-PLAN.md — publish.yml static image-hygiene assertion + boot-smoke before push (IMG-03)
 

.planning/STATE.md

@@ -4,8 +4,8 @@ milestone: v1.1
 milestone_name: Operability & Polish
 status: executing
 stopped_at: Phase 16 context gathered
-last_updated: "2026-06-13T02:50:57.491Z"
-last_activity: 2026-06-12
+last_updated: "2026-06-13T03:25:36.437Z"
+last_activity: 2026-06-13 -- Phase 16 planning complete
 progress:
   total_phases: 19
   completed_phases: 6
@@ -28,7 +28,7 @@ See: .planning/PROJECT.md (updated 2026-06-10)
 Phase: 13
 Plan: Not started
 Status: Ready to execute
-Last activity: 2026-06-12
+Last activity: 2026-06-13 -- Phase 16 planning complete
 
 ### Deferred Checkpoint — Phase 15 Plan 15-03 Task 2 (human-action)