A CacheKeyDecorator runs on the fetch hot path, so a decorator that returns
a huge or per-call growing string is a memory/CPU DoS on every request.
DecorateCacheKey now rejects any decorator output over maxDecoratedCacheKeyLen
(8 KiB), keeping the pre-decoration key — rejecting rather than truncating,
since truncating two distinct over-long keys to the same prefix would silently
collide unrelated cache entries. Rejections surface via the reportCacheKeyOverflow
seam instead of being swallowed. Pinned by TestDecorateCacheKeyRejectsOverlongOutput
(negative-verified). Remaining #53 items (per-plugin capability enforcement,
callback timeouts, reentrant-register policy) are owner-level policy decisions.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…-approved)

Manifest.Requires is now a per-plugin authorization boundary, not just a
host-wide precondition. While a plugin is inside its Setup call, every Add* it
makes is checked against the capability set it DECLARED in Manifest.Requires:
using a capability that is enabled host-wide but undeclared by this plugin fails
registration (and rolls the plugin back). Declaring a capability is how a plugin
authorizes itself to the matching Add* surface (least privilege). Direct host
configuration outside any Setup has no manifest and keeps only the host-wide
check, so non-plugin use is unaffected.

Implemented via a Setup-scoped active-plugin capability set (beginSetup/endSetup,
bracketed by defer so a Setup panic cannot leak the scope; guarded by stateMu so a
concurrent direct Add* cannot race-read it). All three real example-host plugins
already declare exactly what they use, so nothing in-repo needed migration. New
pin (negative-verified): TestSetupEnforcesDeclaredCapabilities.

Remaining #53 items are genuinely owner-level and deferred: a bounded timeout on
a BLOCKING (non-panicking) plugin callback needs a goroutine+context policy
(what to do on timeout); reentrant Register during Setup cannot be safely
distinguished from a concurrent one without goroutine identity (document as
unsupported); BootstrapData nested-value deep-copy (LOW).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>