v0.3.0-rc.1 - plugin host, for plugin authors

A PRE-RELEASE of the v0.3 line. It is cut so plugin authors can consume the SDK at a real
version instead of a branch pseudo-version. v0.3 is NOT complete - do not read this as the
v0.3 release.

The module path moved to github.com/swayyaam/OSCTF. Pin this tag explicitly:

go get github.com/swayyaam/OSCTF@v0.3.0-rc.1

A bare go get github.com/swayyaam/OSCTF still resolves to v0.2.4, which predates the move
of the Go module to the repository root and therefore exposes no importable packages. That
resolves when a stable v0.3.0 ships; until then, pin the tag.

WHAT IS IN IT

• The plugin host: discovery, manifest validation, an 8-state supervisor, a two-level
  in-flight budget, cancel-then-kill drain, restart/backoff/quarantine, and an identity
  cross-check at ready that turns a manifest/binary type mismatch into a load-time
  quarantine rather than a mid-event Unimplemented.
• Three of the four plugin types wired into real requests: challenge-type (verdict computed
  before the transaction, with deleted/swapped challenges failing closed inside the row
  lock), scoring (locked at solve, recorded per solve, with an off-read-path repair worker
  so the scoreboard stays recomputable with every plugin down), and notification (a
  non-blocking event bus with bounded per-subscriber queues and drop-newest, where every
  drop is counted rather than silent).
• The per-challenge type_config channel: author-time ValidateConfig with per-field errors,
  normalized storage, and the stored config passed to CheckFlag at submit.
• API v1 as the canonical surface with /api/v0 kept as a deprecated alias, plus scoped
  bearer API tokens.
• The author kit: plugin/sdk and the plugin/sdk/contract verification helpers
  (VerifyScoring, VerifyNotification, VerifyChallengeType).

WHAT IS NOT IN IT

• Auth plugins. The registrar's auth arm returns nil, so no auth plugin can register, and
  the return-path validation that must ship with it is not written. This is milestone M3.
• The reference plugin set. No plugin has yet been built against a published tag with no
  replace directive and no core source on disk - the gate this tag exists to make runnable.
• The admin Plugins page, the API-token UI, and provider login buttons (M4).
• An adminReloadPlugin endpoint. The supervisor's hot-reload path has no caller.
• The M5 release tier: a plugins CI job, plugin/token/OIDC e2e coverage, and a v0.3.0
  CHANGELOG entry.

No database-schema or API-breaking change relative to v0.2.4 for a deployment running no
plugins; that path is unchanged. There are no API stability promises before v1.0.