Add trusted plugin surfaces

[JMidoro]

Summary

I can now load trusted local plugins from my persistent data directory, with separate entrypoints for my Psycheros embodiment and my canonical entity-core. This adds plugin manifest validation, prompt/context hooks, plugin tools, namespaced routes/assets, entity-core MCP tool/result extension points, plugin status surfacing, and backup/restore support while keeping plugin secrets out of portable exports.

Affected packages

• packages/psycheros
• packages/entity-core
• packages/entity-loom
• packages/launcher
• Workspace root / CI / docs
• packages/launcher-v2
• packages/plugin-api

Checklist

• deno check passes for the affected entry points
• deno lint passes
• deno fmt --check passes
• First-person convention preserved in any new prompts / comments / docs
• If a behavior changed, the relevant docs/ or CLAUDE.md is updated
• If a new external dependency was added, it's justified in the description

Notes

This adds a new workspace package, packages/plugin-api, for shared plugin manifest/types/testing helpers. No new external dependency is introduced.

Focused plugin tests pass with deno test -A packages/plugin-api/tests/.

A full deno task test run currently reaches the existing Windows temp-directory cleanup issue in packages/entity-core/tests/runner_test.ts, where the test cleanup cannot remove a temp directory while a SQLite-backed GraphStore handle is still open. That appears unrelated to this plugin surface.

Related issues

[lyrishark]

Nyx downstream integration found one Windows/Deno type-check issue while merging this plugin surface: setTimeout() in packages/psycheros/src/plugins/plugin-manager.ts can resolve to Node's Timeout type once the workspace's Node typings are active, so let timeoutId: number | undefined fails deno check.

The compatible declaration is:

let timeoutId: ReturnType<typeof setTimeout> | undefined;

We applied that downstream and the combined plugin API/Psycheros/Entity Core suite passes (35 focused plugin tests; 312 full repository tests). Everything else in the host integrated cleanly with our multimodal extensions.