feat: compose MCP and plugin runtime resources

[oratis]

Summary

• compose trusted plugin contributions and MCP servers inside the app-server turn lease
• register eager MCP tools directly and defer opt-out toolkits behind ToolSearch
• expand MCP resource references before provider input and persist value-free startup/resource diagnostics
• gate plugin capability RPC through mode, permissions, hooks, approval, signal, and sandbox context
• deterministically close MCP clients and plugin subprocesses on success, interruption, preprocessing failure, and shutdown
• hash the complete installed plugin tree, reject symlinks, and keep declarative skills-only plugins process-free
• support custom DeepCode data directories for plugin discovery and MCP OAuth storage

Validation

• pnpm format:check
• pnpm lint (one pre-existing unused-import warning)
• pnpm typecheck
• pnpm test (991 passed, 12 skipped)
• pnpm build
• pnpm docs:check
• pnpm --filter @deepcode/desktop test:e2e (4 passed)
• sidecar and VS Code app-server CJS syntax + initialize/diagnostics smoke
• VSIX package smoke (8 files, 170.82 KB)

[oratis]

Review: approved ✅ — with one honest caveat that the PR itself already states

Composes plugin contributions and MCP servers inside the #199 turn lease. The lifecycle discipline is the strong part:

• Deterministic close on success, interruption, preprocessing failure, and shutdown. All four paths, not just the happy one. preprocessing failure is the easily-missed case that otherwise leaks a spawned plugin subprocess on every malformed input.
• Plugin capability RPC gated through mode, permissions, hooks, approval, signal, and sandbox context — a plugin's fs_write/bash goes through the same gate as the model's, so Runtime safety: mandatory policy and real cancellation #181's invariant covers plugins too rather than plugins having a side door.
• Hash the complete installed plugin tree and reject symlinks. Hashing the whole tree (not just an entry file) closes the "swap a required file, keep the entry point" gap, and symlink rejection closes hashing one path while loading another.
• Eager MCP tools registered directly, opt-out toolkits deferred behind ToolSearch. Right default — an MCP server with 80 tools should not consume the context window of every turn.
• Value-free startup/resource diagnostics, consistent with feat: add trust-aware config diagnostics #197/feat: surface config diagnostics in clients #198. Diagnostics that echoed MCP config would leak server credentials.
• Declarative skills-only plugins stay process-free — no subprocess for a plugin that only contributes text.

The caveat, which #209's security-model.md edit states plainly: this gates the supported plugin API, it is not an OS boundary. A malicious plugin can still call Node APIs directly and bypass the capability RPC. I want to explicitly endorse documenting that rather than leaving the old "no host fs/net access" claim standing — the old wording overstated the guarantee, and an overstated boundary is more dangerous than an acknowledged gap. Treat third-party plugins as trusted code until an OS sandbox lands.

Validation: CI green; full suite green locally at the stack tip.