[deploy-plugin DPB-13] Host: async CLI bootstrap, loader isolation, plugin-absent UX

[rickylabs]

Part of #892 (RFC #891; corpus .llm/runs/plan-deploy-plugin--seed/ r5).

Manifest-loader-fed async bootstrap: resolve plugin manifests → validate safe loader subpaths → register built-ins → attach contributed children → program(). Loader failure isolation; install hint when a mount's plugin is absent. Anti-scope: the AST source walker does not feed this registry (SF-4).

Acceptance

• gate: one broken plugin cannot take down the CLI (isolation test)
• gate: an absent-plugin mount prints the install hint
• gate: startup-time budget unchanged for plugin-less projects

Metadata

Dependencies: DPB-12
Delivery shape: CLI bootstrap change