[lweberru]

Fast Application Plans can complete before Cloud Foundry receives a stop request, so the previous observer cannot qualify a hosted interruption. Add an explicit Dev-only, exact-instance native Plan hold and an operator controller that safely prepares one unassigned warm Runner.

The worker requires the fixed route-free Dev CF context, matching app/space/order and a short expiry. It pauses only its spawned process group, confirms both the shell and native tofu plan are stopped, and automatically resumes after 30 seconds. Normal jobs, Apply, platform, drift, destroy and local execution cannot activate it. The controller rotates an atomically leased standby ticket, verifies broker readiness, and accepts only a fresh confirmed hold before stopping the exact Runner. Private intent receipts survive ambiguous responses; no State, native inputs, user authorization or release qualification gates change.

Validation: complete app check; 63 platform State/broker tests; 68 PostgreSQL integration tests including the actual lease SQL; 27 recovery-controller tests; 10 focused worker/real OpenTofu tests covering shell-group hold, continuation and hard interruption; 63 operator CI guards; actionlint; native Plan/Apply contract and real Runner package regressions. English and German runbooks include repeatable preparation, cleanup and evidence limits.

This enables the next authorized disposable Dev drill. It does not itself prove hosted recovery or close #90, #95 or #140.