Closes the "M5.1: 65% — needs live registry wireup" line item.

Core (@deepcode/core):
  · packages/core/src/plugins/wireup.ts (NEW, ~140 lines)
    - wirePlugins({ home, hooks, capabilities, disabled }) — orchestrates
      discoverPlugins → spawnAllPlugins → mergeHooks(declared) for each
      successfully started plugin.
    - WireResult exposes plugins (with contributed hook events), hash
      mismatches, spawn failures, and a shutdown() to kill subprocesses.
    - hasInstalledPlugins() probe helper.
  · packages/core/src/hooks/dispatcher.ts
    - HookDispatcher.mergeHooks(extra: Hooks) — appends matchers under each
      event so plugins can extend dispatch at runtime.
    - `hooks` field changed from readonly to private mutable.
  · packages/core/src/plugins/runtime/subprocess.ts
    - Exposes `get plugin()` and `get isAlive()` accessors so wireup can map
      subprocess back to its source InstalledPlugin without reaching into
      private opts.
  · packages/core/src/agent.ts
    - ToolContext.sessionDir is now derived from
      `${sessions.root}/${sessionId}` so TodoWrite persists to the
      session-scoped dir and /todos can read it back.

CLI (deepcode-cli):
  · apps/cli/src/repl.ts + headless.ts
    - Both bootstraps now call wirePlugins() after HookDispatcher
      construction, build a capability bridge from BashTool/ReadTool/WriteTool/
      WebFetchTool, and shutdown() the wire on exit.
    - SessionContext carries wiredPlugins + pluginWarnings so /plugins can
      render them.
  · apps/cli/src/commands.ts
    - NEW /plugins slash command. Lists active plugins with their version
      and contributed hook events; surfaces hash drift + spawn failure
      warnings.
    - /todos rewritten — now actually reads
      `<sessionsRoot>/<sessionId>/todos.json` via readTodos() helper.

Tests: core 308 → 317 (+9 wireup tests); cli 43 → 47 (+4 /plugins+/todos);
total 360 → 364 passing. (`pnpm -r test`).

BEHAVIOR_PARITY: /todos and /plugins move from 🔄 to ✅.

Acknowledged gaps (M5.2-ext+):
  · OS-level sandbox wrapping of plugin subprocess (M5.1-ext)
  · gh:user/repo + npm install paths (M5.2-rest)
  · Marketplace index + ed25519 signatures (M5.2-rest)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>