fix(plugins): clean residual activation state

[limityan]

Summary

• replace the boolean activation setter with explicit activate/deactivate operations while keeping the product-facing API budget at six symbols
• clear saved activation records before package discovery so missing, corrupt, or temporarily unreadable package roots do not block deactivation
• preserve exact-source semantics: same-ID replacements are reported as residual cleanup rather than claiming the replacement was active
• guard internal rollback by activation epoch and verify trust-store replacement with bounded no-follow readback

Scope

• no plugin execution, final tool registration, installation/uninstallation, new command or flag, hook/event/UI extension API, or external OpenCode directory import
• no trust lifecycle, deny/revoke workflow, general recovery framework, or broad activation-error taxonomy changes
• the only new service error distinguishes deactivation persistence uncertainty; source diagnostics reuse the existing structured issue type
• the discarded broader review implementation remains local and is not part of this PR

Behavior and compatibility

• deactivation removes only the saved activation record and preserves source review history when the package is missing, corrupt, or source scanning is incomplete
• complete discovery distinguishes the exact activated source from a same-ID replacement; incomplete discovery reports package availability as unknown
• stale rollback epochs cannot clear a newer activation, including when source scanning is incomplete
• atomic replacement is followed by bounded no-follow readback; uncertain first-stage or same-ID reconciliation persistence returns an error
• repeating deactivation confirms directory durability and is idempotent
• CLI list/doctor do not render incomplete discovery as unreviewed, inactive, or healthy
• no serialized plugin package or trust-store schema version changes

Verification

• cargo +nightly test -p bitfun-product-domains --test plugin_source_contracts --features plugin-source - 16 passed
• cargo +nightly test -p bitfun-services-integrations --no-default-features --features plugin-source plugin_source --lib - 60 passed
• cargo +nightly test -p bitfun-core --features product-full plugin_runtime::tests - 5 passed
• cargo +nightly test -p bitfun-cli --test plugin_source_cli - 4 passed
• cargo +nightly test -p bitfun-opencode-adapter --test opencode_source_adapter - 18 passed
• node scripts/check-core-boundaries.mjs
• BITFUN_BOUNDARY_CHECK_SELF_TEST=1 node scripts/check-core-boundaries.mjs
• pnpm run check:repo-hygiene
• cargo +nightly check --workspace --exclude bitfun-desktop
• git diff --check

The full workspace check reaches the desktop Tauri build script and requires the generated src/mobile-web/dist directory, which is not present in this clean worktree. The workspace check excluding bitfun-desktop passed with existing warnings in untouched WebDriver and MCP code.

Review

Two fresh, isolated reviewers performed architecture/code and product/documentation reviews. Their findings on same-ID replacement classification, structured diagnostics, persistence retry guidance, second-stage reconciliation durability, and stale-epoch handling under incomplete scans were fixed. Both final re-reviews reported no blocking or high-priority findings.