fix: close plugin lifecycle audit gaps

[kaitranntt]

Summary

• remove and verify marketplace-only Claude plugin state while preserving unrelated plugins, caches, and marketplace entries
• converge deprecated Engineer metadata only with exact staged-byte ownership proof and correct multi-kit boundaries
• harden migration backup and rollback paths against symlink escapes, directory deletion, and unsafe snapshot restoration

Validation

• 5,296 tests passed; 65 expected skips; 0 failures
• 153 UI tests passed
• typecheck, Biome, CLI/UI builds, help parity, npm tarball, and fresh packed install passed
• real Claude/Codex provider canary: 7 passed; host state hash unchanged
• independent lifecycle and rollback containment review: no findings

Docs impact

None. Existing installation documentation already describes the normal-default and explicit plugin opt-in contract; this PR corrects lifecycle enforcement without changing commands or choices.

Closes #914
Closes #917