Add plugin lock-file upgrade

[samuv]

Summary

• Why: Sync restores a pin; teams also need a reviewed path to advance that pin when a mutable source has newer content.
• What:
  • thv ai-plugin upgrade and POST /plugins/upgrade re-resolve each plugins: lock entry's source and install newer content when the digest moved (--preview / --allow-ref-change / --fail-on-changes).
  • Immutable sources (OCI digest or full git commit hash) are reported not-upgradable. Source is never rewritten.
  • A repository move is blocked unless --allow-ref-change is passed. Signer-change guarding is Stack 2 / PR9 — --allow-signer-change is not exposed yet.
  • Preview and --fail-on-changes still fetch OCI artifacts to compare digests (RFC: preview is not side-effect-free) but do not write the lock or install.
  • Gated by TOOLHIVE_PLUGINS_LOCK_ENABLED (403 when off).

Part of #6300. Stack 5/5 — schema → lock-service → install-hooks → sync → upgrade.

Type of change

• New feature

Test plan

• Unit tests (./pkg/plugins/pluginsvc upgrade tests and ./pkg/api/v1 upgrade endpoint tests, with the Taskfile race/ldflags flags)
• Linting (task lint-fix)

Does this introduce a user-facing change?

No by default — the feature is inert unless TOOLHIVE_PLUGINS_LOCK_ENABLED=true. With the gate on, thv ai-plugin upgrade re-resolves plugins: lock entries.

Special notes for reviewers

• No signer-change guard in this PR (PR9). The options type already aliases AllowSignerChange from skills; this PR does not enforce it and does not add the CLI flag.
• resolveLatestState mirrors Install's dispatch (git → OCI → registry name) but stops short of extraction / DB / lock writes.
• Git resolve clones to read HEAD; there is no lighter digest-only primitive, matching skills' "preview is not side-effect-free" note for OCI.

[codecov]

Codecov Report

❌ Patch coverage is 56.73981% with 138 lines in your changes missing coverage. Please review.
✅ Project coverage is 72.92%. Comparing base (f63ae52) to head (d97c97e).

Files with missing lines	Patch %	Lines
pkg/plugins/pluginsvc/upgrade.go	57.53%	67 Missing and 26 partials ⚠️
pkg/plugins/pluginsvc/sync.go	45.28%	23 Missing and 6 partials ⚠️
pkg/plugins/client/client.go	0.00%	12 Missing ⚠️
pkg/api/v1/plugins.go	90.90%	1 Missing and 1 partial ⚠️
pkg/plugins/pluginsvc/install.go	33.33%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@                   Coverage Diff                    @@
##           plugins-lock/04-sync    #6317      +/-   ##
========================================================
- Coverage                 73.01%   72.92%   -0.10%     
========================================================
  Files                       747      748       +1     
  Lines                     79256    79571     +315     
========================================================
+ Hits                      57870    58027     +157     
- Misses                    17278    17409     +131     
- Partials                   4108     4135      +27     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[JAORMX]

Panel review found inconsistent plain-name resolution, ambiguous preview API status, and missing required CLI coverage/completion. Please address the inline findings before merge. The transaction fixes requested on the earlier stack PRs also apply to this upgrade path.

[JAORMX]

Local-store resolution, E2E coverage, and completion were addressed. The local apply path still drops the artifact/reference needed by persisted state and later sync.

[JAORMX]

One merge-blocking stale-plan race remains in the current head.

[JAORMX]

Re-reviewed commit ace63c0 against plugins-lock/04-sync. No new line-level findings in this commit. Current failing checks are mostly GitHub action-download 429/503 failures; the stack also inherits blockers from earlier PRs.

[samuv]

Update

Rebased onto the sync locking fixes and added local-store restorability in 6eaf5cb4c:

• Local upgrades leave ResolvedReference empty (no stale remote pin beside a local digest)
• Sync restores plain-source + empty-reference + digest pins from the local OCI store by exact digest
• Missing digest → digest-missing without mutating DB/lock
• Round-trip tests included

env -u TOOLHIVE_DEV go test ./pkg/plugins/pluginsvc/ -count=1 passes on this branch.

[samuv]

Rebased onto current main (8343851e8). All previously unanswered review threads have replies and are marked resolved — please take another look when convenient.

[JAORMX]

Re-reviewed commit 90543bf against the declared stacked base. No new line-level findings in this commit. The PR remains dependent on unresolved blockers in earlier stack PRs, and several current CI checks are failing.

[samuv]

Rebased onto current main over the lower-stack fixes; no code changes needed here this round.