Add plugin lock-file sync

[samuv]

Summary

• Why: A lock file that is only written on install cannot restore a fresh clone or detect on-disk tampering. Sync is the restore half of RFC THV-0080 for plugins:.
• What:
  • thv ai-plugin sync and POST /plugins/sync restore project plugins from toolhive.lock.yaml (--check / --adopt / --prune, confirmation gate, exit codes 0/2/3/4).
  • Missing or drifted entries are reinstalled at their pinned digest via buildPinnedReference — never re-resolved from source. SyncRestore bypasses the same-digest no-op so on-disk drift is repaired.
  • --check hashes every client's canonical plugin directory (contentDigest), not marketplace.json.
  • --adopt records unmanaged project-scope installs without requiring --allow-unsigned (plugin Sigstore is Stack 2).
  • Gated by TOOLHIVE_PLUGINS_LOCK_ENABLED (403 when off). Upgrade is a 501 stub until the next stack PR.

Part of #6300. Stack 4/5 — schema → lock-service → install-hooks → sync → upgrade.

Type of change

• New feature

Test plan

• Unit tests (./pkg/plugins/pluginsvc sync/pin tests and ./pkg/api/v1 sync endpoint tests, with the Taskfile race/ldflags flags)
• Linting (task lint-fix)

Does this introduce a user-facing change?

No by default — the feature is inert unless TOOLHIVE_PLUGINS_LOCK_ENABLED=true. With the gate on, thv ai-plugin sync restores project plugins from toolhive.lock.yaml.

Special notes for reviewers

• pin.go is copied from skillsvc rather than extracted — agreed: reuse, don't extract.
• Adopt does not require --allow-unsigned. Until Stack 2, lock validation allows an entry with neither provenance nor unsigned. Requiring the flag here would make every plugin adopt fail.
• Upgrade on *service is a 501 stub so PluginLockService type-asserts for /sync. The next PR replaces it.
• Confirmation and exit codes reuse cmd/thv/app/skill_confirm.go and exitcode.go.

[codecov]

Codecov Report

❌ Patch coverage is 70.75000% with 117 lines in your changes missing coverage. Please review.
✅ Project coverage is 73.11%. Comparing base (0b8acf2) to head (a649e0a).

Files with missing lines	Patch %	Lines
pkg/plugins/pluginsvc/sync.go	62.73%	65 Missing and 33 partials ⚠️
pkg/plugins/client/client.go	0.00%	11 Missing ⚠️
pkg/plugins/pluginsvc/pin.go	88.23%	3 Missing and 3 partials ⚠️
pkg/plugins/pluginsvc/install_oci.go	66.66%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6316      +/-   ##
==========================================
+ Coverage   73.04%   73.11%   +0.07%     
==========================================
  Files         745      747       +2     
  Lines       79208    79584     +376     
==========================================
+ Hits        57857    58189     +332     
+ Misses      17300    17282      -18     
- Partials     4051     4113      +62     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[JAORMX]

Panel review found one state-consistency bug plus missing CLI E2E coverage and a thin-wrapper boundary violation. Please address the inline findings before merge.

[JAORMX]

The adoption rollback and CLI E2E findings were addressed. The follow-up panel found a concurrency hole in adoption compensation and incomplete Claude Code registration health checks.

[JAORMX]

Two merge-blocking sync correctness issues remain in the current head.