feat(planstep): report bound recommendations skipped for a term or payment mismatch #1857

Follow-up from the CodeRabbit review of #1834 (part of #1746, bound plans).

What: in resolveService (internal/planstep/resolve.go), a bound identity is marked "shown" by bound.filter before matchesPlan checks its term and payment against the group. If the recommendation's term or payment differs from its group's, matchesPlan skips it. It is then neither bought nor reported as missing (Result.MissingBound only lists identities the strict read did not show). If another recommendation in the step is bought, the step succeeds with no sign that a bound identity was left out.

Why it is low priority: the failure direction is an under-buy, and the same silent skip applies to unbound services today. The group's term and payment come from the plan itself, so a mismatch means the bound set and the group config disagree, which an operator corrects by editing the plan. No money moves wrongly.

Expected: report bound identities rejected by matchesPlan separately from the missing ones (for example a Result.MismatchedBound list, logged at warn like MissingBound), so the operator can see which bound recommendation was skipped and why.

Impact today: latent. No API path creates bound plans yet (slice A of #1746), so fix it before bound-plan creation ships.

Refs #1746, #1834.