…assing

What ships
----------
- plugins/runtime/subprocess.ts (~270 lines)
  · PluginSubprocess class — spawn plugin's index.js as separate node process
  · JSON-RPC stdio bridge — newline-framed, request/response correlated by id
  · Capability methods exposed to plugin (via plugin → host RPC):
    - fs_read(path) / fs_write(path, content)
    - bash(command)
    - fetch(url, opts)
    - log(msg)
  · Token validation on every RPC (defense against unauthorized callers)
  · DEEPSEEK_API_KEY / DEEPSEEK_AUTH_TOKEN env vars STRIPPED in child env
    (plugin cannot exfil host credentials)
  · spawnAllPlugins(plugins, host) / shutdownAllPlugins() bulk helpers
  · generatePluginToken() — collision-resistant token generator

What's exposed in @deepcode/core
- PluginSubprocess / spawnAllPlugins / shutdownAllPlugins /
  generatePluginToken (+ RpcRequest/Response, SpawnAllOpts types)

Tests (5 new, 321 total)
------------------------
- starts subprocess + clean shutdown
- plugin can request fs_read via RPC, host bridge fires + returns
- wrong token rejected (host bridge NOT fired)
- generatePluginToken yields unique values
- DEEPSEEK_API_KEY env var stripped in plugin process

Verified
--------
  pnpm typecheck   → green
  pnpm test        → 313 passed / 8 skipped / 0 failed (was 308)

What's intentionally NOT in this PR (per docs/design/plugin-security.md)
------------------------------------------------------------------------
- OS-level sandbox wrapping (bwrap/sandbox-exec around plugin process):
  M5.1-ext. Currently the plugin can still e.g. open arbitrary network
  connections — the token + env-strip protects host CREDENTIALS but not
  the broader threat surface.
- GitHub URL install ("gh:user/repo")
- npm install
- Marketplace ed25519 signature verification
- Revoke list pull/enforcement
- Wiring spawned plugins into the live ToolRegistry / hook chain — currently
  the subprocess infrastructure exists but the REPL doesn't yet spawn-and-
  register installed plugins. That last-mile wire-up is M5.2.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>