feat: deliver exact Plugin artifacts through current Host authority

Bind remote and in-process delivery to authenticated Worker lineage, live installation permission and persisted exact pins. Verify canonical bytes and complete descriptors in a bounded Runtime-only atomic cache; cache hits reauthorize and process-crash staging never becomes visible.

Shares the exact PluginInstallation permission shape published for T-793; no HTTPS or launch/restore integration is included. Depends on the T-465 source ancestry and the shared Host execution identity helper.

crates/manifest/src/plugin.rs

@@ -602,6 +602,29 @@ pub fn verify_plugin_artifact(
     Ok(package)
 }
 
+/// Static schema identity shared by catalog publication and Runtime verification.
+/// Derivation belongs with the package contract so consumers cannot invent a
+/// different schema hash or namespace while agreeing on archive bytes.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct PluginConfigSchemaIdentity {
+    pub identity: String,
+    pub version: String,
+    pub digest: String,
+    pub namespace: String,
+}
+
+pub fn plugin_config_schema_identity(
+    manifest: &PluginPackageManifest,
+) -> PluginConfigSchemaIdentity {
+    let digest = artifact_digest(manifest.config_schema.as_bytes());
+    PluginConfigSchemaIdentity {
+        identity: format!("{}/config", manifest.id),
+        version: manifest.version.clone(),
+        namespace: format!("{}/config/{}/{}", manifest.id, manifest.version, digest),
+        digest,
+    }
+}
+
 fn artifact_digest(bytes: &[u8]) -> String {
     format!("sha256:{}", hex_lower(&Sha256::digest(bytes)))
 }