feat(plugins): support multiple --plugin-url values and add PluginName newtype

[bug-ops]

Summary

• fix(plugins): --plugin-url only supports a single URL; cannot load multiple ephemeral plugins #4675: --plugin-url now accepts multiple values via ArgAction::Append; --plugin-sha256 removed in favour of inline url@sha256 syntax per URL. Runner iterates over all URLs and passes the full Vec<TempDir> to with_ephemeral_plugins().
• fix(plugins): plugin identifiers use raw String throughout — no newtype safety #4674: PluginName newtype introduced in zeph-plugins — TryFrom<String> / TryFrom<&str> validate via validate_plugin_name() at construction; Deserialize delegates to TryFrom (never bypasses validation); Serialize is transparent. AddResult, InstalledPlugin, and AutoUpdateResult carry PluginName instead of raw String.

Breaking changes

• --plugin-sha256 CLI flag removed; use url@sha256 inline syntax instead
• .name on AddResult, InstalledPlugin, AutoUpdateResult is now PluginName; use .name.as_str() or .name.to_string() where &str / String is required

Test plan

• cargo nextest run --workspace --lib --bins — 10572 passed, 22 skipped
• cargo +nightly fmt --check — clean
• cargo clippy --workspace --features desktop,ide,server,chat,pdf,scheduler -- -D warnings — clean
• RUSTFLAGS="-D warnings" cargo check --workspace --all-targets --features desktop,ide,server,chat,pdf,scheduler — clean
• Two new unit tests for parse_plugin_url_arg (multiple @, bare @, empty string)
• PluginName doc-tests cover happy path, empty string, >64 char rejection
• Manual Deserialize for PluginName rejects invalid names; transparent Serialize roundtrips correctly

Closes #4675
Closes #4674