Make native Plugins gateway-only

[yyjeqhc]

Summary

• remove startup/direct Native Plugin promotion and keep provider tools behind one stable plugin_tool gateway
• make plugin_tool canonical across ToolDefinition, tool_manifest, MCP, and generic/OpenAPI runtime
• preserve exact Runner/provider/tool/schema binding with no retarget, fallback, or blind replay
• share action-aware Plugin scope, Session, permission, and audit governance across MCP and API transports
• live-apply [plugins] through the same atomic candidate/commit path as generic Runner config reload
• narrow committed Plugin environment identity to Plugin-relevant shell/profile inputs
• make explicit plugin_tool reload restart providers even when runner.toml is unchanged, so code-only Plugin edits become active
• document and validate the gateway-only Native Plugin contract, including the safe-delete example

Review validation

• Server Plugin / MCP / generic / OAuth / OpenAPI: 40/40 passed
• Runner Plugin: 34/34 passed
• webcodex-tool-contracts: 88/88 passed
• safe-delete Node tests: 16/16 passed
• node --check plugins/safe-delete/plugin.mjs
• cargo fmt --all -- --check
• git diff --check origin/main...HEAD
• clean merge-tree simulation against current origin/main

No deploy, Runner restart, merge, or release performed.