feat(plugins): add AutoMTLS, binary integrity verification, and log forwarding

[pocky]

Summary

• Add automatic mutual TLS (AutoMTLS) to all host-plugin gRPC communication, providing zero-config encryption without requiring plugin authors to manage certificates
• Implement SHA-256 binary integrity verification at plugin launch time, blocking tampered or corrupted plugin binaries with a new EXECUTION.PLUGIN.CHECKSUM_MISMATCH error; checksums are stored automatically on awf plugin install
• Forward plugin subprocess logs and stdout/stderr to AWF's zap-based structured logger via a new HCLogAdapter, including secret masking for sensitive fields
• Add awf plugin verify [name] [--update] CLI command to inspect and update stored plugin checksums out-of-band

Changes

Domain

• internal/domain/errors/codes.go: Add ErrorCodeExecutionPluginChecksumMismatch error code (EXECUTION.PLUGIN.CHECKSUM_MISMATCH, exit code 3)
• internal/domain/errors/codes_test.go: Add taxonomy and constant tests for the new error code
• internal/domain/pluginmodel/state.go: Add Checksum and ChecksumAt fields to PluginState (omitempty; backward-compatible)
• internal/domain/pluginmodel/state_test.go: Add JSON round-trip, omitempty, and backward-compat unmarshaling tests for new checksum fields

Infrastructure — Logger

• internal/infrastructure/logger/hclog_adapter.go: New HCLogAdapter bridging hclog.Logger to zap.Logger; new LogWriter capturing plugin stdout/stderr line-by-line; both integrate with existing SecretMasker
• internal/infrastructure/logger/hclog_adapter_test.go: Full unit test suite covering level mapping, secret masking, With/Named/ResetNamed, and LogWriter edge cases

Infrastructure — Plugin Manager

• internal/infrastructure/pluginmgr/rpc_manager.go: Enable AutoMTLS, wire HCLogAdapter and LogWriter as Logger/SyncStdout/SyncStderr in startPluginProcess; add verifyChecksum() with fail-fast enforcement before process start; add SetStateStore() and SetZapLogger() setters; pass SecureConfig to go-plugin when a stored checksum is available
• internal/infrastructure/pluginmgr/rpc_manager_test.go: Add tests for SetStateStore, verifyChecksum (no store, no checksum, match, mismatch), and Init fail-fast on mismatch
• internal/infrastructure/pluginmgr/state_store.go: Add SetChecksum() and GetChecksum() methods backed by the Checksum/ChecksumAt fields in PluginState
• internal/infrastructure/pluginmgr/state_store_test.go: Add tests for SetChecksum/GetChecksum including error paths and disk round-trip

Interfaces — CLI

• internal/interfaces/cli/plugin_cmd.go: Add awf plugin verify subcommand; compute and persist SHA-256 checksum after plugin install; fix enable JSON output key ("plugin" → "name"); introduce collectInstalledPluginNames, findPluginDir, and verifyOnePlugin helpers
• internal/interfaces/cli/plugin_cmd_test.go: Update subcommand list to include verify; fix JSON assertion for renamed "name" key; remove tests migrated to integration suite
• internal/interfaces/cli/run_plugin_provider_wiring_test.go: Adjust wiring tests after new setter methods

SDK

• pkg/plugin/sdk/serve.go: Minor update (likely to align handshake or AutoMTLS compatibility)

Integration Tests

• tests/integration/cli/plugin_security_test.go: End-to-end tests for AutoMTLS, checksum mismatch detection, tampered binary rejection, and install-time checksum persistence
• tests/integration/cli/plugin_verify_test.go: End-to-end tests for awf plugin verify (all plugins, named plugin, --update, PASS/FAIL/MISSING output)

Architecture Config

• .go-arch-lint.yml: Allow infra-plugin to depend on infra-logger; allow zap and go-hclog in infra-plugin; allow go-hclog in infra-logger

Documentation

• README.md: Update plugin system feature description; add awf plugin verify to command table
• docs/README.md: Update plugins.md link description to mention transport security
• docs/reference/error-codes.md: Add EXECUTION.PLUGIN.CHECKSUM_MISMATCH reference entry with resolution steps
• docs/user-guide/commands.md: Add awf plugin verify command reference with flags, status table, and examples
• docs/user-guide/plugins.md: Add "Verify Plugin Integrity" and "Plugin Security" sections covering AutoMTLS, binary integrity verification, and log forwarding

Test plan

• Install a plugin and confirm checksum is stored: awf plugin install <owner/repo> → check storage/plugins.json contains "checksum": "<sha256>"
• Tamper with a plugin binary and confirm rejection: echo "x" >> ~/.local/share/awf/plugins/<name>/awf-plugin-<name> → awf run <workflow> should fail with EXECUTION.PLUGIN.CHECKSUM_MISMATCH
• Run awf plugin verify to see PASS/FAIL/MISSING per installed plugin; run awf plugin verify --update <name> to recompute and confirm PASS on next run
• Run unit and integration test suites: make test-unit and make test-integration pass with no failures

Closes #332

---

Generated with awf commit workflow