feat(launch): forward PHASES_SPEC/backend to watchdog; mark plan Phase 4 as operator gate

The watchdog is spawned into the existing tmux server and didn't reliably
inherit a custom PHASES_SPEC — it would fall back to the default 11-phase
spec and mis-detect completion. Forward PHASES_SPEC/PHASE_IDX_FILE/
LOOP_BACKEND/LOOP_MODEL explicitly in the watchdog command so custom
single-phase runs (like the mirror-enroll plan) work end-to-end. Also make
the mirror-enroll plan's live-host-deploy step an explicit claim-and-wait
operator gate for the loops.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cc-ci-plan/plan-mirror-enroll-all-recipes.md

@@ -59,9 +59,12 @@ do). Commit to the cc-ci product repo. Final `POLL_REPOS` = cc-ci + all 19 recip
 
 ### Phase 4 — deploy to the live cc-ci host  ⚠️ OPERATOR GO-AHEAD GATE
 `cd /root/cc-ci && nixos-rebuild switch --flake .#cc-ci` on the cc-ci host (or the repo's deploy path).
-Restarts the bridge with the new poll set. **This is the one high-impact step** (live CI server); do
-not run without explicit go-ahead. Note: `/root/cc-ci` on the host is an operator-synced copy — confirm
-it's at the committed head first (this was a noted gap: no self-service host rebuild path).
+Restarts the bridge with the new poll set. **This is the one high-impact step** (live CI server).
+**LOOPS: do NOT run this yourselves.** CLAIM this gate in STATUS — state the exact command, that
+`/root/cc-ci` is at the committed head, and that Phases 1-3 are Adversary-verified — then WAIT for the
+operator to perform/approve the rebuild. (Footgun is mitigated now that `#cc-ci` → the Hetzner host
+config via `be4f451`, but the live-host rebuild stays an operator action.) Note: `/root/cc-ci` is an
+operator-synced copy — there is no self-service host rebuild path (a known gap).
 
 ### Phase 5 — verify `!testme` triggerability
 For 2-3 newly-enrolled recipes, post `!testme` on an open PR (or a scratch PR) and confirm a Drone