feat(plugins): install trusted OCI plugins and bridge Outlook MCP

[killswitch-GUI]

Summary

• Fix portable plugin MCP registration and make installed signed plugins manageable in Desktop.
• Add colossus plugin install oci://... with digest-pinned signature verification and a built-in Obscurity Labs publisher trust profile.
• Add an opt-in, signed-digest-bound Outlook Classic user-session companion. The agent keeps its windows_job boundary and connects through an authenticated loopback MCP endpoint.
• Preserve existing Workspace plugin server override semantics while allowing new per-server edits; revoke companion credentials on plugin disable, removal, or uncertain outcomes.

Validation

• Subagent code review completed; addressed authority, connection inheritance, and companion lifecycle findings.
• cargo xtask check desktop passed (425 UI tests, security contracts, format, build, bundle-size).
• Focused Desktop Rust tests for configuration inheritance and Outlook connection persistence passed.
• cargo xtask pre-commit passed.
• Strict documentation build and CLI docs examples passed earlier on this branch.
• Signed Outlook Classic release 0.1.0-alpha.4.ci.7.1 from Add authenticated Outlook Classic user-session companion colossus-plugins#1 published and verified its OCI registry round trip; digest sha256:e95973e1eb55062d92d8c8810788d142cf62ac94bc7f0b3d5bf49f70e9b5342a was pulled with signature referrers.

The full local Rust gate was interrupted by Windows disk exhaustion; hosted PR validation includes Rust unit tests, and pre-merge acceptance runs cargo xtask check rust on Linux. The signed alpha.4 OCI digest was installed directly from GHCR using the built-in Obscurity Labs trust profile, enabled, and discovered through its portable outlook-classic/mail declaration under windows_job. An actual Colossus agent used the signed companion against a synthetic Outlook PST, called the intended read tools, bounded one body read, left unread state and fixture unchanged, detached the PST, and verified the audit chain. The exact signed helper also passed two fresh start/authenticate/discover/shutdown cycles with bearer, Host, and Origin denial checks.

Closes #245
Relates to #246

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.