Declare target effects and gate them at plan time

### Problem

Fallout targets range from writing into `artifacts/` to publishing packages to nuget.org and tagging releases. Nothing in the target model distinguishes them. A caller that wants to run a build without changing anything outside the working tree has no way to ask which targets are safe.

For an automated caller the only safe policy is therefore to never run the build unattended, which removes most of the value. The Continuous Delivery direction (milestone #8) adds deployment targets, which widens the gap.

### Outcome

A target declares the class of effect it has, and the runner refuses to reach a target whose effect class was not granted.

Sketch:

```csharp
Target Compile => _ => _
.Effect(Effects.LocalFilesystem)
.Executes(...);

Target PushToNuGet => _ => _
.Effect(Effects.RemoteMutation, Effects.Irreversible)
.Executes(...);
```

`fallout run Pack --allow local` succeeds. A plan that reaches a `RemoteMutation` target fails during planning, before any target executes, naming the target and the grant it needs.

### Acceptance criteria

- [ ] Targets can declare one or more effect classes
- [ ] Effect classes are checked at plan time, so a run stops before the first target executes
- [ ] The error names the target and the grant required
- [ ] Effect classes propagate through dependencies: depending on a remote-mutation target requires that grant
- [ ] `describe --json` exposes each target's effect classes

### Open questions

- Is an undeclared target permissive or restrictive by default? Restrictive is safer, but changes behaviour for every existing build.
- Fixed set of effect classes, or an open set that plugins can extend?
- Does the contract belong in the plugin SDK, given #100 (plugin discovery and load model) has to settle a related trust question?

### Notes

Useful outside automation too: `--allow remote` as a CI-only flag prevents accidental publishes from a developer machine.