feat(cli): gonext plugin test — in-process fake host + conformance suite

[tayebmokni]

Closes #247.

Adds an offline conformance harness so plugin authors can test their
plugins against an in-memory fake host without standing up Postgres /
Redis / the wazero runtime.

What ships

• packages/go/plugins/fakehost/ — in-memory implementations of every
  host ABI (gn_db_, gn_kv_, gn_cache_invalidate, gn_http_fetch,
  gn_media_read, gn_users_read, gn_secrets_get, gn_audit_emit,
  gn_cron_register, gn_log, gn_time_ms, gn_i18n_translate,
  gn_metric_observe, gn_event_emit, gn_span_event, gn_panic,
  http.serve). Every call is recorded as a typed Event with a
  deterministic clock the test can advance. Capability denial, KV
  quotas, scripted HTTP responses, and a secrets bag that never echoes
  values into the trace are all wired.

• packages/go/plugins/conformance/ — scenario runner driving the
  fake host. Built-in scenarios assert: declared capabilities are in
  the v1 vocabulary (plus legacy hooks.subscribe/jobs.enqueue),
  capabilities cover the manifest's hook registrations
  (save_post/publish_post need posts.write), hook names are
  non-empty, jobs are namespaced under the plugin slug,
  init+teardown is idempotent, and a synthetic 1s budget is
  respected. Parses both the v1 manifest schema and the legacy
  apiVersion-form (so the existing examples/plugins/seo bundle
  passes without modification).

• cli/gonext/cmd/plugin/test.go — extended with --suite=conformance
  and --record-fixtures=DIR. The default suite (no flag, or
  --suite=default) continues to run the existing plugintest
  contract checks unchanged — marketplace ingest stays on the stable
  shape.

• tests/conformance/fixtures/ — README + a seo_init.json sample
  fixture demonstrating the JSON format. The runner's
  LoadFixtureScenarios helper picks *.json files up
  automatically; round-tripping --record-fixtures → load is
  covered by tests.

Tests

• Unit tests for every fake-host method (KV round-trip, quota,
  capability gating, secret-trace hiding, scripted HTTP, concurrent
  safety).
• Unit tests for every conformance scenario.
• Integration: gonext plugin test --suite=conformance examples/plugins/seo runs end-to-end and reports
  conformance PASS — 6 scenarios (0 failed, 1 skipped). (The one
  skip is limits.budget, which reports reason wasm-not-wired — it
  upgrades to a real meter check when the runtime is wired to
  conformance in a follow-up.)
• TestRunTest_Conformance_SEOExample smoke-tests the end-to-end
  path against examples/plugins/seo from the CLI test suite.

Out of scope

• Wiring the conformance scenarios into the actual wazero runtime
  (driving a plugin's WASM init from the conformance runner). The
  conformance package is structured so this drops in as the body of
  driveSyntheticInit once the runtime integration lands.
• YAML fixture format — JSON is what --record-fixtures emits and
  what authors paste back; YAML can be added in a follow-up if
  demand materialises.

Run locally:

gonext plugin test --suite=conformance examples/plugins/seo
gonext plugin test --suite=conformance --json examples/plugins/seo
gonext plugin test --suite=conformance --record-fixtures=tests/conformance/fixtures examples/plugins/seo

🤖 Generated with Claude Code