Add PluginLockService and managed install flag

[samuv]

Summary

• Why: Sync and upgrade operate over a project's whole plugins: lock key, not a single named plugin — a different shape than PluginService. Lock-managed installs also need a durable marker so sync --prune can tell lock-managed plugins apart from ones a user installed by hand.
• What:
  • PluginLockService interface (Sync, Upgrade) with generated mock, kept separate from PluginService (mirrors SkillLockService).
  • Aliases for the existing skills lock types (SyncOptions/SyncResult/UpgradeOptions/…) so plugin callers do not import pkg/skills for an identical shape.
  • InstalledPlugin.Managed + migration 005 (installed_plugins.managed), wired through the SQLite store. Create/Update reject Managed on user-scoped installs.

Part of #6300. Stack 2/5 — schema → lock-service → install-hooks → sync → upgrade. Based on #6303 (PR1); no new consumers yet — pluginsvc wiring lands in PR3.

Type of change

• New feature

Test plan

• Unit tests (task test — ./pkg/storage/sqlite and ./pkg/plugins with race detector; full task test still has pre-existing pluginsvc SSRF/git-ref failures on main, none in these packages)
• Linting (task lint-fix)

Added: migration test proving 005 defaults existing rows to unmanaged and its Down cleanly drops the column without disturbing 002–004 tables; store-level round-trip test for Managed (create, then flip via Update); project-scope invariant test.

Does this introduce a user-facing change?

Yes — InstalledPlugin gains a managed field, visible in the existing GET/list plugins API responses (swagger updated accordingly). No new endpoints yet. The field is always false until PR3 starts recording lock-managed installs (still gated).

Implementation plan

Approved implementation plan (PR2 slice)

PluginLockService mirrors SkillLockService. Reuse skills lock option/result types via aliases. SQLite managed flag on installed_plugins, default 0. Only ever true for project-scoped installs. No sync/upgrade implementation in this PR.

Special notes for reviewers

• Sync/Upgrade are not implemented on pluginsvc yet — this PR only adds the interface, types, and storage. Callers land in PR3–PR5.
• JSONB encoding in Create/Update is extracted to encodePluginJSONFields so adding the managed-scope check does not trip gocyclo on Create.

[codecov]

Codecov Report

❌ Patch coverage is 74.19355% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 72.85%. Comparing base (0302206) to head (ee84e75).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/storage/sqlite/plugin_store.go	74.19%	5 Missing and 3 partials ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #6311   +/-   ##
=======================================
  Coverage   72.85%   72.85%           
=======================================
  Files         742      742           
  Lines       77804    77816   +12     
=======================================
+ Hits        56683    56694   +11     
- Misses      17145    17148    +3     
+ Partials     3976     3974    -2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[samuv]

Summary: The lock-service separation and managed persistence largely mirror the established skills design cleanly. I found one API-facade gap: the aliased enum types do not expose their constants through the plugins package. Checklist — Tests: comprehensive storage/migration coverage and all CI checks pass; Docs: generated Swagger updated; Registry impact: none; Security: no regression found; Backwards compatibility: additive schema/API change, with the facade gap noted inline.