Govern specialized Plugin and SSH invocations

[yyjeqhc]

Summary

• route native Plugin and managed SSH operations through one Server-owned specialized governance primitive without converting them into static ToolDefinition/ordinary ToolCall entries
• split Plugin authority into exact plugin:inspect, plugin:invoke, and plugin:manage scopes; shared-key OAuth Plugin opt-in grants inspect+invoke only and direct shared-key baseline remains Plugin-free
• require explicit Workflow Session authority when a recording Session is supplied, apply lifecycle/read-only guards before effectful dispatch, and evaluate consequential specialized operations exactly once through the runtime-held PermissionEvaluator
• record bounded specialized provenance with resolved operation/effect/risk/permission/dispatch certainty while keeping opaque Plugin bindings, provider instances, arbitrary Plugin arguments, SSH targets/cwd, and credentials out of the ledger projection
• preserve exact Runner/provider/revision fencing and not_started / completed / outcome_unknown semantics

Integration review

Fresh independent review was performed after #304, #305, #306, and #307 were already on main. The branch was consciously rebased onto current main@373bb7d8; the rebase was clean. In particular, #305 remains authoritative for Runner-side frozen Native Plugin provider contracts and RunnerRegistry response validation, while this PR owns Server-side specialized scope/session/permission/audit governance.

The review found one small classification bug: plugin_tool check correctly required plugin:manage and was shell-like, but its authoritative effect/risk was still classified as local execution. Reviewer commit 92aeab68 now classifies check as management while keeping it non-write-like + shell-like; reload remains management/write-like/shell-like and SSH register/remove remain management/write-like/non-shell-like.

Fresh validation

• Plugin policy classification regression: 1 passed / 0 failed
• specialized governance/session/permission tests: 4 passed / 0 failed
• Plugin MCP focused tests: 25 passed / 0 failed
• managed SSH MCP focused tests: 6 passed / 0 failed
• Plugin OAuth/scope focused tests: 4 passed / 0 failed
• cargo check -p webcodex --lib passed
• cargo check -p webcodex-cli passed
• cargo fmt --all -- --check passed
• git diff --check and staged diff check passed

No full workspace test, deploy/restart, or branch-protection change was performed.