docs(plan): record the cut — the migration flags and --wait are wave 3

The plan's status header, decisions table, build order, acceptance criteria and
risks now say that wave 2 is the claim handoff alone, and that `--wait`/
`--timeout` and `--from-file`/`--from-key`/`--from-env`/`--delete-source` move to
wave 3 with their decisions kept, so reopening them starts from them. The index
row in `plans/README.md` follows.
