[codex] Plugin runtime stage 2 dispatch activation

[winrey]

Summary

• Adds a capability router and activation model that derives exec, file, and browser availability from first-party plugin state plus daemon host configuration.
• Advertises active capabilities in the existing Hello payload while keeping legacy protocol capability names stable.
• Gates cloud WebSocket and debug IPC JobRequest, FileRequest, and BrowserRequest dispatch before invoking existing handlers, returning host-neutral remediation messages when capabilities are unavailable.

Validation

• rustfmt --edition 2024 --config skip_children=true --check crates/ahandd/src/ahand_client.rs crates/ahandd/src/browser.rs crates/ahandd/src/ipc.rs crates/ahandd/src/main.rs crates/ahandd/src/plugin_runtime/activation.rs crates/ahandd/src/plugin_runtime/capability.rs crates/ahandd/src/plugin_runtime/mod.rs
• cargo test -p ahandd plugin_runtime
• cargo test -p ahandd ahand_client
• cargo test -p ahandd ipc
• cargo test -p ahandd --test hub_handshake
• cargo test -p ahandd --test hello_signature
• cargo test -p ahandd browser_setup
• cargo test -p ahandd --test browser_doctor
• cargo check -p ahandd -p ahandctl
• cargo build -p ahandd --bin ahandd
• target/debug/ahandd plugin host-resource --json
• target/debug/ahandd plugin doctor
• git diff --check 8d65c32..HEAD

Note: full cargo fmt -- --check still reports existing unrelated formatting drift in file manager/store/test files, so this PR only formats the Stage 2 files it touches.