Load server plugins from the deployment bucket at runtime

[nicosuave]

Today, adding or changing a deployment plugin means rebuilding and redeploying Artifacts. This lets a server-only plugin be published into a running deployment instead.

• scripts/bundle-plugin.ts <plugin.ts> --out <file> turns a definePlugin(...) module into one JSON record. The record holds the plugin's metadata and schemas, plus one bundled module containing its handlers, their dependencies, the shared dispatcher and standalone Ajv validators.
• Publish with celld r2 put artifacts-plugins plugins/<name>.json … or wrangler r2 object put … to an optional PLUGINS R2 binding. Without the binding nothing changes.
• The host reads the record (5s per-isolate cache) and runs the module in its own isolate through the existing LOADER. The isolate's env holds only the record's declared secrets.
• The isolate runs the same createPluginDispatcher as build-time plugins (moved to src/plugins/dispatch.ts), so schemas, authorize, timeouts, size limits and error messages match. plugins_list, artifact_plugin_call, pluginCall and the gallery route all work unchanged.
• Published plugins can only declare PLUGIN_* variables. Write access to the bucket can't read BETTER_AUTH_SECRET, provider credentials or fleet tokens.
• Build-time plugins win on a name clash. Browser modules still need a deployment build.

Tests:

• cloudflare/runtime-plugins.test.ts (Miniflare): listing, a call's identity and secret isolation, the full error matrix (including corrupt records and a record asking for a host variable), and republishing without a host deploy.
• cloudflare/runtime-plugins-celld.test.ts: the same path end to end on celld 0.6.1. Added to test:celld.
• Full typecheck, test, test:cloudflare and typecheck:cloudflare pass.