Bind the two import-less plan sketches from their definers, not from pool coincidence

[gunbai-bot]

dag/gunbc/plans/branch_merge_admission_model.dag and merge_admission_gate_shape_proposal.dag are the only two of ~46 table-using modules under dag/gunbc/plans/ that carry no imports at all. They have had none since #6927/#7254, so every cross-module name in them binds by pool-membership coincidence: resolve_in finds the definer exactly when something unrelated in the currently-assembled closure has already dragged it in. That is the Class B pathology DESIGN's #6985 thread names, and its stated remedy is import-from-definer.

How it surfaced

It stopped being latent on #7862, whose compile-clean refused 127 names in exactly these two files — 96 cell and 31 row, an exact match to their 96 and 31 usages, so every occurrence failed while h2/h3/p/li/ul/quote from the same module resolved fine. Those two are md_helpers' only helpers whose signatures mention std.markdown's table types.

Why this lands separately from the PR that surfaced it

#7862 touches claim_executor.rs, and a non-selectable .rs path forces compile-clean to the whole-tree baseline:

compile-clean scope: touched path outside the selectable universe
  — compiler/infra change, whole-tree baseline

Main pushes get the scoped path instead — main@4f9112965 ran 396 affected entries (floor fast path) and passed without compiling these modules at all. Main's last whole-tree compile was 1d17ae068, which predates #7824.

So a whole-tree-only regression can merge to main and stay invisible until an unrelated PR happens to touch a .rs file. That exposure belongs to the gate, not to the PR that trips it, and this repair unblocks every .rs-touching PR rather than one. The scoped/whole-tree asymmetry is worth a separate look; it is the coverage-by-illusion tier DESIGN §6 describes.

What is proven, and what is not

Proven by execution — both modules compile with 0 blocking error(s) after this change, and the import lists are exactly complete. Adding md_helpers alone flips each module from ambient bare resolution to import-scoped visibility, which then refuses Plan and HasTrigger; gunbc.plan is therefore imported too, after which nothing is left unresolved. That mode flip is why the fix is two imports and not one.

Not proven — I could not reproduce the original refusal locally. Under an --entry closure both modules compile clean on main and on #7862's tree, so the refusal is closure-dependent and needs CI's whole-tree witness_layer_roots closure to appear. This change is therefore justified by mechanism, not by a local red-to-green: explicit imports make binding independent of pool composition, which is precisely the property whose absence produced the refusal.

Attribution between #7824 and #7862 is not established here, and no claim about it is made. Three hypotheses were formed and refuted by execution rather than acted on: a colliding row binder from #7862 (refuted — 158 files on main already use (row:, 44 use row =>); md_helpers absent from the pool (refuted — its MarkdownBlock-returning siblings resolve in the same files); and pre-existing breakage on main (refuted, then re-opened once main's clean whole-tree run turned out to predate #7824).

Import sets match the sibling convention used verbatim by ci_merge_freshness, ci_oom_reclassification and emission_ingestion_inverse.