feat: add plan step

Signed-off-by: kjuulh <contact@kjuulh.io>

interface/proto/forest/v1/policies.proto

@@ -76,7 +76,7 @@ message PolicyEvaluation {
     bool passed = 3;
     // Human-readable explanation when blocked
     string reason = 4;
-    optional ExternalApprovalState approval_state = 10;
+    optional ExternalApprovalState external_approval_state = 10;
 }
 
 // ── CRUD messages ───────────────────────────────────────────────────

interface/proto/forest/v1/releases.proto

@@ -297,8 +297,16 @@ message GetPlanOutputRequest {
   string stage_id = 2;
 }
 message GetPlanOutputResponse {
-  string plan_output = 1;
-  string status = 2;  // RUNNING, AWAITING_APPROVAL, APPROVED, REJECTED
+  string plan_output = 1;            // deprecated: use outputs
+  string status = 2;                 // RUNNING, AWAITING_APPROVAL, APPROVED, REJECTED
+  repeated PlanDestinationOutput outputs = 3;
+}
+
+message PlanDestinationOutput {
+  string destination_id = 1;
+  string destination_name = 2;
+  string plan_output = 3;
+  string status = 4;                 // SUCCEEDED, FAILED, RUNNING, etc.
 }
 
 service ReleaseService {

interface/proto/forest/v1/runner.proto

@@ -99,6 +99,16 @@ message RegisterAck {
   string reason = 3;
 }
 
+// Execution mode for a work assignment.
+enum ReleaseMode {
+  RELEASE_MODE_UNSPECIFIED = 0;
+  // Normal deployment execution.
+  RELEASE_MODE_DEPLOY = 1;
+  // Dry-run / plan only (e.g. terraform plan). Runner should capture
+  // plan output and include it in CompleteRelease.plan_output.
+  RELEASE_MODE_PLAN = 2;
+}
+
 // Work assignment pushed to a runner when a matching release is available.
 message WorkAssignment {
   // Scoped opaque auth token. Use this for GetReleaseFiles, PushLogs,
@@ -111,6 +121,8 @@ message WorkAssignment {
   string destination_id = 5;
   // Full destination configuration including metadata.
   DestinationInfo destination = 6;
+  // Execution mode. Defaults to DEPLOY if unset.
+  ReleaseMode mode = 7;
 }
 
 // Destination configuration sent with the work assignment.
@@ -201,6 +213,9 @@ message CompleteReleaseRequest {
   ReleaseOutcome outcome = 2;
   // Error description when outcome is FAILURE.
   string error_message = 3;
+  // Plan output text when mode was "plan" and outcome is SUCCESS.
+  // Stored in release_states.plan_output for UI review.
+  optional string plan_output = 4;
 }
 
 enum ReleaseOutcome {