Plan agent runtime kill switches from action severity, blast radius, trigger clarity, rollback path, and owner coverage