Dander 0.4.0rc1: manifest-scoped connector plugins

[harrisonoconnorhover]

Summary

• add optional exact plugin pins to dander.yaml and activate only declared dander.connectors entry points
• publish a typed plugin API v1 contract and registry while preserving all built-in engines
• add dander plugins install plus source-free Dockerfile installation
• prepare, but do not publish, 0.4.0rc1

Compatibility

Existing manifests without plugins remain unchanged. Explicit plugins may replace a matching built-in engine; two plugins claiming the same engine fail clearly. Authentication remains in Dander core, and Salesforce has not moved yet.

Checks

• uv run ruff check .
• uv run ruff format --check .
• uv run mypy src tests
• uv run pytest — 690 passed
• Terraform platform and stage-zero init/validate with backends disabled
• dependency audit — no known vulnerabilities
• wheel/sdist build, archive validation, and outside-checkout installation
• generated source-free project validation for both artifacts
• local container build and CLI startup
• final adversarial review — PASS

No tag, PyPI publication, Terraform apply, GCP mutation, Salesforce repository creation, deployment, or schedule change occurred.