Wire event-driven plugin-input bumps (repository_dispatch from plugin repos)

[rynfar]

Follow-up from #635 (@connor-grady). The daily cron in .github/workflows/update-plugins.yml is a stopgap — the right trigger is event-driven:

1. Create a fine-grained PAT with contents: write (or a GitHub App) authorized for this repo, stored as a secret in each plugin repo (meridian-plugin-hermes-scrub, meridian-plugin-opencode-scrub, meridian-plugin-pi-scrub).
2. Each plugin repo gains a small workflow that fires repository_dispatch (e.g. event_type: plugin-updated) at rynfar/meridian on push to its default branch.
3. update-plugins.yml adds repository_dispatch: { types: [plugin-updated] } to its on: block — the update logic needs no changes and the cron stays as a safety net.

Only the repo owner can mint the PAT/App credentials, which is why this didn't ship with #649.

[rynfar]

All the wiring is built and merged — only the credential step remains, which needs your hands:

Merged:

• Receiver: update-plugins.yml now accepts repository_dispatch: {types: [plugin-updated]} (ci: accept repository_dispatch for plugin-input bumps (#650) #653); cron stays as safety net
• Senders: notify-meridian.yml in all three plugin repos (hermes-scrub#4, opencode-scrub#8, pi-scrub#6) — fire on push to main, plus workflow_dispatch for testing. They no-op silently until the secret exists, so nothing breaks in the meantime.

Your 5-minute part:

1. Mint a fine-grained PAT at https://github.com/settings/personal-access-tokens/new: Resource owner rynfar, Repository access → Only select repositories → rynfar/meridian, Permissions → Contents: Read and write (that's what the repository_dispatch API needs). Set a long expiry.
2. Store it in each plugin repo (paste the token at the prompt in your own terminal):

   for r in meridian-plugin-hermes-scrub meridian-plugin-opencode-scrub meridian-plugin-pi-scrub; do
     gh secret set MERIDIAN_DISPATCH_TOKEN --repo rynfar/$r
   done

3. Validate end-to-end without a dummy commit:

   gh workflow run notify-meridian.yml --repo rynfar/meridian-plugin-pi-scrub
   # then watch rynfar/meridian → Actions → 'Update plugin inputs' for a repository_dispatch-triggered run

Once you've confirmed the triggered run, this issue can close.