refactor: adopt current Planner selection API before the feature stack

[zzylol]

Why

Move Planner API and selection semantics ahead of the stacked feature work, so main can adopt merged ASAPPlanner #455 without depending on evidence/workload costing in #761. Based on main after #767.

What

Pin Planner cd7e9e0f (ProjectASAP/ASAPPlanner#460), use costed candidate search and selected-DAG assembly for single-query and workload selection, and remove the first-candidate helpers, uncosted-selection compatibility, deprecated physical API/type aliases, and query_plan::logical re-exports. Reports use candidates and candidate IDs. Removed snapshot spellings are rejected.

How

The backend supplies an explicitly analytical retained-state estimate through candidate_cost. Accuracy, logical selection and physical admission remain separate. Unknown guarantees remain explainable but cannot authorize a summary deployment; supplied uncertified readouts are rejected. ERP resource matching and complete workload costing stay in #761.

Before this PR

Upgrading Planner alone breaks selection/tests: callers use obsolete APIs or assume HLL RSE and ERP observed maximum error certify a confidence guarantee. A single-query helper can take an enumerated candidate without global costed selection.

After this PR

Both paths use the current Planner selection contract. Uncertified HLL/ERP queries retain exact execution; process tests verify exact endpoint routing, unchanged query/time parameters and response forwarding. No legacy selection adapter is retained.

Evidence

The dependency-only upgrade produced 51 failing control-plane tests. With this adaptation, all 427 control-plane library tests pass. The new direct-admission regression failed before the guard and passes after it.

Verification

• Main workspace unit tests: 427 control-plane, 1,161 data-plane, 108 shared-type tests passed, plus binary and integration tests.
• Process and documentation tests: completed separately after correcting the old uncertified-sketch expectations; the existing Collector-schema-dependent test remains ignored.
• cargo clippy --workspace --all-targets --locked -- -D warnings
• cargo fmt --all -- --check; git diff --check

Architectural decisions

Use the Planner's current search/selection API rather than an adapter around removed selection behavior. Analytical state bytes are a local selection proxy; this PR makes no full-workload cost or measured-benefit claim.

Limitations and follow-up

#737 will stack on this PR. The remaining #761 stays after #766 and contains scoped evidence, ERP/analytical resource matching and automatic workload costing. #759 remains its full acceptance layer; existing level-3 local-execution blockers are not claimed resolved by this API change. The default Planner HLL model currently supplies RSE with unknown failure probability; this is a missing estimator confidence model, not a claim that HLL cannot support probabilistic guarantees.

Human review — do not complete with an agent

• The MVP boundary is correct.
• New conceptual layers or public interfaces are necessary.
• The before/after description matches the intended product behavior.
• Human reviewer:
• Decision and rationale:

Depends on ProjectASAP/ASAPPlanner#460, which adds an opt-in bounded classic-HLL confidence model; its CI passes. The default HLL contract remains unknown. Backend evidence binding and execution coverage stay in #761. cargo check --workspace --locked also passes with this final dependency revision.