test: close plugin scratch leaks

[ken-jo]

Why

Three plugin test surfaces created temporary directories without durable test-owned cleanup. The runtime incarnation cases also require lifecycle teardown before filesystem removal so cleanup cannot race pending disposers or HostApi operations.

What changed

• register every temporary plugin manifest root and whitelist cache root immediately after creation, then await the shared bounded cleanup helper
• route all eight runtime data-directory allocations through an immediate registry
• deactivate each registered incarnation, await remaining disposers, and drain tracked operations before deleting its data directory
• retain the intentionally never-settling lifecycle-hook case after confirming it only holds in-memory lifecycle state and performs no file I/O

Risk

Test-only lifecycle cleanup. Production runtime behavior is unchanged.

Validation

• bun run test:vitest -- src/plugins/__tests__/plugin-app-visibility-guard.test.ts src/plugins/runtime/__tests__/runtime-state-incarnation.test.ts src/plugins/whitelist/__tests__/secret-gate.test.ts — 3 files, 53 tests passed
• bun run typecheck
• pre-push gate: typecheck, test-typecheck baseline/self-test, duplicate-helper policy, and all 3 targeted test files passed
• git diff --check
• no new bare recursive rmSync; no recent matching temporary directories remained after the focused run