WIP: add trusted custom plugin harness

[JMidoro]

Summary

Adds a trusted, in-process custom plugin harness so local extensions can survive upstream updates without requiring forks. Plugins can extend Psycheros prompt construction, tools, routes, browser assets, and lifecycle hooks, while entity-core plugins can add MCP tools and additive result decorators.

Plugin-owned credentials live outside portable backups under .psycheros/plugin-secrets/<id>.env. The shared plugin API includes validation, isolated test fixtures, focused coverage, and a manual-install validator.

Affected packages

• packages/psycheros
• packages/entity-core
• packages/entity-loom
• packages/launcher
• Workspace root / CI / docs

Also updates packages/launcher-v2 backup warnings and rollback-preservation coverage.

Checklist

• deno check passes for the affected entry points
• deno lint passes
• deno fmt --check passes
• First-person convention preserved in any new prompts / comments / docs
• If a behavior changed, the relevant docs/ or CLAUDE.md is updated
• If a new external dependency was added, it's justified in the description

No new external dependency was added. The shared API uses the existing hoisted @std/dotenv dependency.

Related issues