[codex] Add plugin runtime stage 1

[winrey]

Summary

• Adds Stage 1 plugin runtime plumbing with built-in manifests, dependency ordering, host-resource snapshots, and CLI doctor/install surfaces.
• Moves browser setup paths under ~/.cache/ahand-runtimes/ahand-primary-runtime and models browser-playwright-cli as dependent on shell and node.
• Exposes getHostResource through the admin API, tightens the TypeScript contract for plugin status/platform/arch, and includes the local Stage 1 implementation plan doc.

Validation

• cargo test -p ahandd plugin_runtime
• cargo test -p ahandd browser_setup
• cargo test -p ahandd --test browser_doctor
• cargo check -p ahandd -p ahandctl
• cargo build -p ahandd --bin ahandd
• pnpm --filter @ahand/admin exec tsc -p tsconfig.json --noEmit
• pnpm --filter @ahand/admin build
• target/debug/ahandd plugin host-resource --json
• target/debug/ahandd plugin doctor
• git diff --check c2f0754..HEAD

Notes

• browser-doctor exits with 1 on this host because the managed runtime does not yet have Node.js or playwright-cli installed; it reports the expected browser-init --step node and browser-init --step playwright remediation commands.
• The local worktree still has an unrelated unstaged pnpm-lock.yaml change from pnpm resolution noise; it was intentionally not included in this PR.