Publish runtime plugins as TypeScript source

[nicosuave]

Follow-up to #53 and #54. A deployment repo had to commit a minified JSON bundle per plugin and verify it in CI. Now it uploads the plugin's TypeScript source to plugins/<name>.ts and Artifacts compiles it.

• On first use of each source version, a node compiles it with the existing @cloudflare/worker-bundler path and compile queue that scripts use. The plugin is one file: it may import @sidequery/artifacts/plugins, supplied as a virtual module, and Workers builtins. The isolate wrapper (src/plugins/runtime-entry.ts) is prebuilt into dist/cloudflare/plugin-runtime.json.
• The host learns operations and schemas by asking the plugin to describe itself in an isolate with no secrets. The name must match the object key, and secrets must still be PLUGIN_*.
• Input and output are validated on the host with @cfworker/json-schema (draft 7, interpreted), because Workers cannot compile Ajv validators at runtime. Authorization, secrets, the 30s timeout and error messages still go through the shared dispatcher in the plugin's isolate.
• Compiled plugins are cached by source hash; source reads keep the 5s cache. A plugin that fails to compile or describe is left out of plugins_list, and calls to it return Plugin configuration unavailable, with the reason in the log.
• Removes scripts/bundle-plugin.ts and the .json record format, which only shipped in Load server plugins from the deployment bucket at runtime #53/Make published plugin bundles reproducible #54.

Tests:

• Miniflare runtime-plugin tests cover listing, isolation, the full error matrix (bad schemas, wrong name, uncompilable source, external imports, host-variable secrets, invalid output) and republishing.
• The celld runtime-plugin test passes.
• test:cloudflare and test pass. An auth-flow socket hang-up and a celld startup timeout during the full runs were from load on the test machine and passed on rerun.