[Feature] Isolate capability plugin faults and measure the runtime lifecycle #102

Summary

Fourth of four PRs for #98 (design: specs/014-capability-plugin-spi/). Hardens plugin isolation and measures the cost of the runtime lifecycle from #97.

Scope

• A hook that throws or returns invalid data marks its provider FAILED and withdraws it through the [Bug] Disabling a capability at runtime leaves it active for clients that negotiated it #97 lifecycle (prune, CAP DEL). Core state already committed stays.
• Bounded, rate-limited diagnostics for plugin faults.
• Load test: publishing a capability state change at 1,000 sessions, p99 at most 100 ms; message throughput regresses by no more than 10% against main, or the regression is justified.
• Update server-configuration.md and irc-protocol-commands.md with the final lifecycle and failure policy.

Acceptance

• Fault-injection tests per hook type, over real sockets where the hook affects wire output.
• ./gradlew loadTest results recorded in the PR.

Part of #98. Depends on #97.