feat: compose Subject Ticket assignment with selected dependency contracts

Adapt T-778 source 6d15569 and selected T-465 plugin plans on T-803 51f0c7e0. Preserve frozen Workspace107 and append Subject108, current assignee/target checks, recipient-scoped notification recovery and public contract generation. This is a candidate composition, not target adoption.

resources/config-schema/fixtures/plugin-preflight.json

@@ -0,0 +1,21 @@
+{
+  "schema": "{ plugins = { enabled = { echo = { installation_id = String; expected_last_operation = String; package_digest = String; artifact_digest = String; tools = [...String]; logging = Bool default false; connections = { ...String } default {}; config = { mode = String; }; }; }; bindings = {} default {}; }; }",
+  "cases": [
+    {
+      "source": "{ plugins.enabled.echo = { installation_id = \"i\"; expected_last_operation = \"op\"; package_digest = \"package\"; artifact_digest = \"artifact\"; tools = [\"echo\"]; config.mode = \"test\"; }; } as WorkspaceConfigSchema",
+      "mode": "test"
+    },
+    {
+      "source": "{ plugins.enabled.echo = { installation_id = \"i\"; expected_last_operation = \"op\"; package_digest = \"package\"; artifact_digest = \"artifact\"; tools = [\"echo\"]; config = { mode = \"test\"; unknown = true; }; }; } as WorkspaceConfigSchema",
+      "diagnostic": "constraint_violation"
+    },
+    {
+      "source": "{ plugins.enabled.echo = { installation_id = \"i\"; expected_last_operation = \"op\"; package_digest = \"package\"; artifact_digest = \"artifact\"; tools = [\"echo\"]; config.mode = 42; }; } as WorkspaceConfigSchema",
+      "diagnostic": "constraint_violation"
+    },
+    {
+      "source": "{ plugins.enabled.echo = { installation_id = \"i\"; expected_last_operation = \"op\"; package_digest = \"package\"; artifact_digest = \"artifact\"; tools = [\"echo\"]; config.mode = String; }; } as WorkspaceConfigSchema",
+      "diagnostic": "materialize"
+    }
+  ]
+}

resources/config-schema/plugins.dcdl

@@ -0,0 +1,31 @@
+let
+    PluginEnablement = {
+        installation_id = String;
+        expected_last_operation = String;
+        package_digest = String;
+        artifact_digest = String;
+        tools = [...String];
+        logging = Bool default false;
+        connections = { ...String } default {};
+        config = { ...Unknown } default {};
+    };
+in {
+    plugins = {
+        enabled = { ...PluginEnablement } default {};
+        bindings = { ...{
+            origin = String;
+            network = String default "public_internet";
+            methods = [...String];
+            path_prefixes = [...String];
+            request_headers = [...String] default [];
+            response_headers = [...String] default [];
+            secret_ref = String default "";
+            limits = {
+                timeout_ms = Int;
+                max_request_bytes = Int;
+                max_response_bytes = Int;
+                max_header_bytes = Int;
+            };
+        } } default {};
+    } default {};
+}

resources/config-schema/profile-authoring.dcdl

@@ -76,6 +76,13 @@ let
             search = { enabled = Bool; provider = String; api_key_secret = String; timeout_secs = Int; base_url = String; country = String; search_lang = String; ui_lang = String; safesearch = String; };
             fetch = { enabled = Bool; timeout_secs = Int; redirect_limit = Int; max_response_bytes = Int; max_output_bytes = Int; allow_private_addresses = Bool; };
         };
+        plugins = { selections = [...{
+            installation_id = String; tools = [...String]; logging = Bool;
+            https_slots = [...String];
+            # 非秘密のoverrideは補完用のshapeではなく、導入済みpackageの
+            # closed typed schemaで検証する。
+            config = { ...Unknown };
+        }]; };
         skills = { directories = [...String]; };
     };
 in {