Plugin contract: stdout reserved for go-plugin handshake, logs must use stderr

[mwaldheim]

Critical constraint from hashicorp/go-plugin: the host reads the subprocess stdout at startup to get the gRPC socket address. Any write to stdout by a plugin corrupts this handshake and silently breaks the connection.

Rule: plugins must NEVER write to stdout. Use hclog with Output: os.Stderr exclusively.

Tasks:

• Add hclog scaffolding to plugin SDK template
• Add golangci-lint custom rule or go vet check flagging os.Stdout writes in plugins
• Document stdout/stderr contract in docs/plugin-development.md
• Add test verifying plugin stdout violation produces a clear CI error

[mwaldheim]

Progress update (2026-05-23):\n\n- Documentation updates for stdout/stderr contract were added in PR #104 (plugin docs in go-semrel-docs).\n- Remaining code-level safeguards (lint/vet rule + test for stdout violation) are still open.\n\nStatus: keep open; partially addressed by PR #104.