feat: harden Phase 2 workspace plugin contracts

[xiayh17]

Summary

• implements the authorized non-routable Phase 2 contract slice for workspace plugin manifest validation, canonical digest/discovery, typed host identity, constrained grants, declarative contributions, and project-isolated lifecycle state;
• implements the authorized pure-contract Phase 2.5 remediation for observation/provenance, staging, sealed evaluation, manual promotion, A5 policy gates, repair, and permission-safe gardening; and
• closes the independent review findings with deterministic negative and two-project regression coverage.

Stack dependency

This implementation is stacked on Phase 1 PR #75. Its current head includes the exact Phase 1 head plus the hosted Windows cache-contamination repair commit e1422f1; after PR #75 merges, the Phase 2 diff can be rebased onto main without changing the Phase 2 contract commit.

Validation

Local:

• cargo test -p rho-extension-runtime: 153 passed;
• cargo clippy -p rho-extension-runtime --all-targets -- -D warnings: passed;
• cargo fmt -p rho-extension-runtime -- --check: passed;
• cargo build --workspace: passed;
• git diff --check: passed;
• independent remediation review: no unresolved blocking finding.

Hosted, exact head 12860008381910d8280d277ea1006ab04746b281:

• Draft Fast run 32326311932: passed;
• Ready Rust Compatibility run 32326626971: all six stable/MSRV platform legs passed;
• stacked Phase 1 repair run 32326278723: all six legs passed, including the repaired Windows installer build/install/smoke/remove path.

The repository-wide rustfmt check was not claimed from the shared local worktree because it contains a separate uncommitted ProjectQueryService/Mutation refactor; the clean hosted checks passed repository-wide formatting. No files from that separate lane are included in this PR commit.

Deliberately open gates

This PR does not select or ship a real Web Worker/Wasm host, execute project-authored code, perform privileged I/O, persist grants/evolution state, expose plugin UI, or claim installed-platform/release acceptance. Those remain separately gated by the active Phase 2/2.5 contracts.