[Herklos]

Summary

• Adds packages/python/server/tests/router/test_plugin_dispatch.py with direct unit tests for the dispatchers in starfish_server/plugins.py: dispatch_authorize, dispatch_before_pull, dispatch_after_write, dispatch_intercept_push, dispatch_intercept_pull, and has_authorize_hook.
• Pins the rules the end-to-end suites do not isolate:
  • first non-proceed directive wins and later hooks do not run;
  • gating hooks (authorize, before_pull) propagate exceptions, so access fails closed;
  • after_write logs a failing hook and still runs the remaining hooks;
  • context fields reach the authorize hook unchanged.
• Adds one CHANGELOG bullet under the current ### Changed section.

Test-only change

No file under src/ is modified. The only runtime-adjacent file touched is the CHANGELOG.

Verification

• uv run pytest tests/router/test_plugin_dispatch.py -v: 23 passed.
• Full packages/python/server suite: 813 passed, 35 deselected.
• Mutation check: changing the dispatch_authorize short-circuit to never return on reject makes 2 of the new tests fail. Source restored afterwards.

Out of scope

• No source or lockfile changes.
• The restrictions package end-to-end tests are unchanged.