docs: require immutable plugin kit pins

[offendingcommit]

Summary

• document immutable Git commit pins for hermes-plugin-kit consumers
• require one shared kit revision when several plugins share a Python environment
• keep the repository guidance aligned with the minilab bootstrap and refresh preflight contract

Validation

• make test (86 tests)
• git diff --check

Post-Deploy Monitoring & Validation

• confirm each profile's plugin lock preflight reports one kit version and source
• confirm gateway startup emits one successful registration receipt per plugin
• rollback by reverting this documentation commit if the consumer contract changes

branding: on