[KhushiTrivediii]

Fixes #927.

Vets the downloaded update jar manifest identity in PluginUpdateBridge before unloading the running plugin instance. Refuses updates where the declared pluginId does not match the expected pluginId or is in NOT_USER_INSTALLABLE.

[choksi2212]

Cross-referencing for the maintainer's triage — a pattern across this author's open PRs, verified by file-list comparison:

Five open PRs share one working tree. #960 (24 files), #1084 (24), #1085 (25), #1102 (25 — identical list to #1085), and #929 (20) each open with a one-line "security fix" title while carrying nearly the same full diff: parallel implementations of the update-jar identity vet (#951's territory, with its own duplicated test class), the atomic engine swap (#946), the editor save confinement (#891), the navigation scheme gate (#955/#916), the stripped-name git validation (#950/#934's territory), the constant-time token compare (#1040), and the atomicWrite prefix padding (#1036). Each PR re-lands the same 20-25 files under a different title; the titles describe only a fraction of each diff.

The hackathon criteria state duplicated submissions are explicitly not counted. One reviewer sweep of this file set, cross-referenced against the open PRs it duplicates, is the fastest way to verify the pattern; the per-PR breakdowns are posted on #1085 and #1102.

What legitimately remains hers: each PR's stated subject is a real fix that another contributor already has open with the underlying issue filed, the first fix written, and tests in review. The cleanest resolution for the maintainer: close the superseded copies, and let each stated subject live in its existing first-mover PR (all of which are green).

[fluck-boss]

Thanks so much for this contribution, @KhushiTrivediii - the work here is genuinely appreciated, and it's clear real care went into it.

This overlaps with #1330 ("fix(persist): force temp bytes to disk before the atomic move in File.atomicWrit"), which is further along in review and will carry this change forward. To keep review attention focused, I'm closing this one in favor of #1330 - please do review and follow that PR, and you're very welcome to pick up any part of it that still needs help or take on another open issue.

Your contribution credit is noted here, and anything unique in this branch that #1330 misses is still welcome as a follow-up. Thanks again for contributing to BossConsole!