Fixes marketplace source-update timeout reporting and surfaces bounded pnpm install diagnostics. Adds exact package-scoped pnpm build allowance for reviewed plugins that declare installation lifecycle scripts, enabling dsh-plugin-agent-workflow without allowing unknown dependency scripts.