Fix/plugin audit findings (#2031)

* fix(plugins): enforce manifest apiVersion at install and activation

* test(plugins): exercise the absent-apiVersion default

* feat(plugins): generate the core-event catalog into host-facts

* docs(plugins): explain the packing.listBags write-permission binding

* test(plugins): cover apiVersion upload refusal; tidy docblocks and generator header

* fix(plugin-sdk): validate settings options and oauth like the host

* fix(plugin-sdk): model the full manifest shape and stop dropping fields

* fix(plugin-sdk): drop non-string routeProfiles icons like the host

* docs(plugin-sdk): document host limits, oauth contract, and ignored asUserId

* feat(plugin-sdk): enforce daily budgets and meta quotas in the mock host

* feat(plugin-sdk): expose the generated core-event catalog

* feat(plugin-sdk): scaffold trek range >=3.4.0 <5.0.0 ahead of TREK 4.0

* feat(plugin-sdk): scaffold the oauth broker settings for oauth:client plugins

* chore(plugin-sdk): fix stale mirror docs and the colliding permissions export

* docs(plugin-sdk): add the rate-limit string; restore trek docblock; match host meta sizing

* feat(plugin-sdk): raise the scaffold trek floor to 4.0.0

* docs(wiki): bring the plugin pages in line with the current runtime

* docs: bring the workspace CLAUDE.md guides up to date and make them committable

* feat(plugin-sdk): roll back failed publishes, add unrelease, sync the fork, retro-sign updates

* docs(wiki): document the publish rollback, unrelease, fork sync, and retro-signing

* chore(plugin-sdk): 1.6.0

server/src/nest/plugins/protocol/envelope.ts

@@ -7,6 +7,14 @@
  * or the websocket server. Keep it dependency-free.
  */
 
+/**
+ * The plugin-API surface version (#plugins, M4) — bumped on any breaking change to the
+ * ctx methods / manifest shape a plugin author can rely on. Mirrored into every
+ * manifest as `apiVersion`; the install and activation gates refuse a plugin declaring
+ * a version newer than this one.
+ */
+export const PLUGIN_API_VERSION = 1;
+
 export type PluginErrCode =
   | 'PERMISSION_DENIED' // a real method the plugin was not granted
   | 'UNKNOWN_METHOD' // not a method the host exposes at all
@@ -202,6 +210,10 @@ export const METHOD_PERMISSION = {
   'packing.create': 'db:write:packing',
   'packing.update': 'db:write:packing',
   'packing.delete': 'db:write:packing',
+  // Intentional: bags are the write-side organizational structure of packing —
+  // a read-only consumer uses packing.list; only bag-managing (write) plugins
+  // need the bag tree. Moving this to db:read:packing would strip access from
+  // every installed write-only plugin and force consent re-prompts.
   'packing.listBags': 'db:write:packing',
   'packing.createBag': 'db:write:packing',
   'packing.updateBag': 'db:write:packing',