feat(plugins): let a plugin keep a process running behind a handle (#2027)

Closes #1826

API 1.3 adds `run-command` (one-shot with stdin, cwd and environment) and a handle-based `start` for a long-running process with incremental stdin/stdout/stderr, both gated by the existing `process:<program>` grants. A plugin's environment entries are append-only: a key the child would already inherit (including the login-shell PATH) is refused with an error naming it, as are empty or malformed keys. Processes run in their own process group and are killed with their descendants when the handle is dropped, the plugin is disabled, unloaded or reclaimed, or the owning window closes; at most eight handles per plugin. Output is bounded and UTF-8 safe, stdin writes honour cancellation, and validation failures return typed errors instead of trapping the plugin. Verified on macOS; Windows/Linux not run.

Co-authored-by: chaoes <[email protected]>

plugins/official/string-tools/dist/plugin.wasm.sources

@@ -1 +1 @@
-343c6d46b9bf07f8631f16dbc737301a02a6b229b17eb0a455207509823680e1
+2504128882832c282d627946668f10603fe4b165dca8f12a49131934d1a5c09d