Support nested extra plugin sources

[chubes4]

Summary

• Add explicit nested/monorepo extra plugin recipe fields: sourcePath, sourceSubdir, and mountSlug.
• Preserve existing source/slug/sourceRoot/sourceSubpath behavior while validating pluginFile against the mounted plugin slug.
• Validate source subdirectory traversal, missing nested source directories, and plugin file mount-slug mismatches.
• Document the public nested plugin contract and clean up public docs boundary wording caught by the docs-boundary test.

Downstream contract shape

{
  "sourcePath": "/repo",
  "sourceSubdir": "plugins/example-plugin",
  "mountSlug": "example-plugin",
  "pluginFile": "example-plugin/example-plugin.php"
}

sourcePath can also point directly at the plugin source directory; keep mountSlug and pluginFile explicit when the source directory name is not the WordPress mount slug.

Tests

• npm exec tsx tests/recipe-extra-plugin-nested-source.test.ts
• npm run test:recipe-validation-descriptors
• npm run test:recipe-runtime-setup-staged-materialization
• npm run test:recipe-source-packages
• npm run test:docs-boundary-language
• npm run build

AI assistance

• AI assistance: Yes
• Tool(s): openai/gpt-5.5 via OpenCode
• Used for: Implementing the recipe contract change, tests, docs updates, and local verification.