[contursofran]

Fixes #713

Slice S3 of the Setup checklist: the plugin actions (D283, owner decision D65).

Steps

1. setup.RunPlugin: runs only CopyPlugin or CopyEnable with the claude the checks find; the error is the last stderr line.
2. Settings → Setup: the contr plugin row gets Install / Enable right of Copy. A click opens a ui.AlertDialog confirm with the exact copy line; Run runs it off the UI thread (Env.Do) with a 2 min limit (PluginTimeout). Spinner while it runs, last stderr line in blocked on failure, recheck on success. Seam: Settings.PluginRun.
3. Sheet part SettingsSetupPlugin (failed Install + open confirm); SettingsSetup now shows Enable.
4. Docs: D283, docs/spec/SettingsSetup.md.

No other row gets an action; meter, gh and hc stay copy only.

Tests

go test ./internal/app/settings -run Plugin, go test ./internal/setup -run RunPlugin. No e2e test covers this tab; none run. Sheets: scripts/sheet.sh SettingsSetup SettingsSetupPlugin (Dark and Light, checked by eye).

Pre-check

1. Tests: undone change → failed: no recheck → TestPluginEnableRunsTheLineAndRechecks; no error text → TestPluginInstallShowsTheLastErrorLine, TestPluginTimeout; Cancel/Escape runs → TestPluginCancelAndEscapeRunNothing; no spinner → TestPluginSpinnerWhileRunning. The IDPlugin guard in pluginAction is redundant with the Copy match, so removing it alone fails nothing; TestPluginNoButtonOnReadyAndCopyOnlyRows covers the rows.
2. Plan: every point of the brief done.
3. Contract: D283 id; command text equals the copy line (setup.CopyPlugin / CopyEnable).
4. Up to date: merged origin/main; no open PR touches these files.
5. Diff read: no leftovers; spec line "contr runs no command for the owner here" updated.
6. Coverage: Onboarding: a setup checklist that shows what contr needs and installs it #713 S3 done (S1, S2 merged).
7. Duties: nothing removed; Copy stays.
8. Evidence: sheet PNGs in tmp/sheet/SettingsSetup*-{dark,light}.png (local).