feat(plugins): add read-only lifecycle control plane

[phodal]

Summary

• add typed, read-only plugin status, plugin plan, plugin verify, and doctor flows across eight supported hosts and eleven host surfaces
• centralize validated host profiles, scope/provenance observations, fail-closed planning, native home bindings, and shell-neutral human output
• keep Pi persistent and session-only loading distinct, isolate Codex CLI/Desktop evidence, and harden Qwen project-scope provenance
• document the portable lifecycle contract in English and Chinese and add the implementation spec at docs/specs/2026-07-31-better-harness-plugin-lifecycle.md

Why

Lifecycle evidence and mutation planning previously depended on provider-specific assumptions that could borrow discovery, scope, or installation state across surfaces. This change introduces a shared read-only control plane so callers can inspect and plan against explicit evidence without executing host mutations.

Impact

Users and automation can query normalized status, verification, doctor, and deterministic plan envelopes. Unknown, mixed, foreign, or unbound host state fails closed. plugin apply remains intentionally unregistered, so Better Harness does not execute lifecycle mutations.

Validation

• npm test — 1163/1163 passed
• node --test test/doc-link-graph.test.mjs — 6/6 passed
• npm run pack:verify — 401 npm entries and 424 runtime zip entries
• isolated public CLI smoke — eight doctor targets, eleven lifecycle rows, ready Qwen project install plan, and no real HOME leakage
• git diff origin/main...HEAD --check

Risk and follow-up

The native help fixture is contract evidence rather than live cross-platform acceptance. Real Codex Desktop, Pi same-session, and Windows host smoke remain follow-up validation boundaries.