[Plugins] Manifest schema, validator, and dry-run CLI #1069

Part of #1068.

Scope

Define and implement the author-time plugin.manifest.json schema, a validator, and a squad plugin dry-run command that reports what an install would do - without writing anything.

Requirements

• Publish a JSON Schema (or equivalent) for plugin.manifest.json v0.1.
• Manifest fields cover identity (name, version, description, authors, license), components (agents, skills, knowledge, memory, routing, decisions, hooks metadata, adapters metadata), and squad engine compatibility range.
• Excluded by design (per epic): verificationStatus, featureStatus, distribution, MVP permission grants, install source/ref. SemVer prerelease handles alpha/beta channels.
• squad plugin validate <path> returns structured errors with field paths.
• squad plugin dry-run <source> [--ref <ref>] resolves the source, reads the manifest, and prints:
  • Identity + resolved ref/digest (preview).
  • Files that would be written (paths + sizes).
  • Risks inferred from declared components only (no speculative capabilities).
  • Expected plugin.lock.json preview.
• Unit tests cover manifest validation success/failure cases and dry-run output stability.

Acceptance

• Schema published in repo + linked from docs.
• validate and dry-run commands implemented and tested.
• Dry-run output is deterministic for the same input.

Planning provenance: tamirdresher_microsoft/tamresearch1#2917.