[Plugins] Security gate: no arbitrary execution, no hidden capabilities #1076

Part of #1068.

Scope

Define and enforce the security gate: the MVP plugin system must not provide any path to arbitrary code execution or hidden capabilities.

Requirements

• Written threat model covering: malicious manifest, malicious git source, malicious lock file, malicious adapter metadata, malicious hook metadata, malicious knowledge/memory content.
• Enforcement tests that fail CI if any of the following is reachable from install, enable, disable, switch, uninstall, or dry-run:
  • eval-equivalent execution of plugin-supplied content.
  • Spawning child processes from plugin-supplied scripts.
  • Filesystem writes outside the plugin's declared component paths under .squad/.
  • Network egress initiated by plugin-supplied content.
• Adapter declarations and hook metadata are recorded but never executed by Squad MVP - covered by explicit negative tests.
• Capability surface is fully derived from declared components; no speculative capability strings accepted.
• Document the security posture in the user-facing docs and link it from the install command's --help.

Acceptance

• Threat model document committed.
• Negative test suite green in CI and gating merges.
• Docs reflect the gate.
• Any future relaxation requires an RFC and explicit lift of this gate.

Planning provenance: tamirdresher_microsoft/tamresearch1#2927.