Apply effective stealth remote launch defaults

[ecochran76]

Summary

• route ordinary launches through effective service access-plan defaults when callers do not explicitly choose profile, host, headless mode, executable, or browser build
• add the Google Sheets built-in site policy for the inspectable stealth remote lane
• add Plan 0016/0017 evidence and an authenticated dashboard smoke profile option

Validation

• cargo fmt --manifest-path cli/Cargo.toml -- --check
• node --check scripts/smoke-local-dashboard-runtime.js
• git diff --check
• cargo test --manifest-path cli/Cargo.toml service_model -- --test-threads=1
• cargo test --manifest-path cli/Cargo.toml native::actions -- --nocapture --test-threads=1
• cargo clippy --manifest-path cli/Cargo.toml -- -D warnings
• pnpm --dir docs build

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}