PLC9: close Plugin management, isolation, package security, and cleanup

[zhnt]

Objective

After PLC8 is complete and its three-view review findings are fixed, close Plugin management projections, package supply-chain security, isolated Worker execution, retained-version GC, repair, and destructive-data lifecycle.

Hard prerequisite

• PLC8: publish the Plugin author SDK and converge managed Skill actions #508 is closed as completed.
• PLC8 architecture, correctness/security, and Product/test reviewers have re-reviewed every fix.
• No PLC9 implementation begins before that gate.

Ordered scope

1. Unify CLI/RPC/UI/SDK projections over the durable Plugin management service and repair workflow.
2. Make Package lifecycle the sole bounded acquisition/quarantine/extraction/dependency-verification/publication owner; allow verified wheels only unless a separately contained build service is accepted.
3. Add versioned local_worker declarations and a supervised, required-containment Worker envelope over authorized Process Host.
4. Remove peer manifest.enabled/source.enabled runtime-selection vetoes after migration.
5. Implement retained-version and orphaned-generation GC, separately confirmed private-data deletion, backup retention, and partial-retirement repair.
6. Remove superseded compatibility adapters. Evaluate remote_service only as a later separately accepted topology.

Exit gate

• every management surface calls one service;
• install/inspect/validate/activate cannot execute untrusted source builds or escape quarantine;
• containment is non-downgradable and same-user child process is never called a Sandbox;
• remove, retirement, GC, and data deletion remain distinct and diagnosable;
• incomplete termination is never reported as disabled or removed;
• three independent review views pass and every blocking finding is fixed/re-reviewed;
• full cross-platform, non-live, architecture, Ruff, and mypy gates pass.

Canonical plan: docs/internals/architecture/harness/plugin/plugin-lifecycle-coding-pluginization-plan.md.

This issue is Product/Harness work only. It does not authorize MCP expansion, marketplace work, remote-service shortcuts, or a second Plugin/Graph/Resource authority.