Add plugin CLI workflows, documentation, and end-to-end acceptance

[yacosta738]

Goal

Expose the plugin lifecycle through a coherent CLI and document the supported cross-agent workflow.

CLI scope

• agentsync plugin add <plugin>@<marketplace>
• agentsync plugin update [<plugin>@<marketplace>]
• agentsync plugin list [--json]
• agentsync plugin remove <plugin>@<marketplace>
• Clear dry-run, offline, drift, unsupported-component, and authentication errors.
• Stable JSON output suitable for CI and contract tests.
• Integrate plugin reconciliation into agentsync apply without breaking existing skill/MCP behavior.

Documentation scope

• Configuration and lockfile reference.
• Public/private marketplace examples.
• Pinning and update workflow.
• Clone/bootstrap expectations.
• Security model and unsupported plugin components.
• Migration guidance from direct vendor CLI installs and agentsync skill install.

Acceptance scope

• Clean-clone fixture with isolated HOME/CODEX_HOME.
• Apply, list, update, remove, dry-run, offline, and drift scenarios.
• Claude/Codex skill visibility and MCP output checks.
• Failure-path coverage for bad pins, bad hashes, collisions, unsupported components, and missing credentials.
• Full focused verification evidence recorded in the parent issue.

Dependencies

Blocked by #574 and coordinated with #575 and #576.

Non-goals

Do not promise automatic installation of vendor caches when the vendor requires explicit user consent. Document discovery versus installation semantics precisely.

[linear-code]

DALLAY-589