Support hosted skill-only Plugins and capability directories

[SaladDay]

Hosted environments previously rejected Plugin packages and capability directories. This change lets inline and template configurations install skill-only Plugin ZIPs and snapshot workspace directories after setup. Codex, Claude Code and MiniMax Code load the selected Skills through the shared Runtime contract, preserve package-relative resources, and reuse installed contents during cold continuation.

Core keeps Plugin contents encrypted and public responses metadata-only. Initialization remains owned by the existing allocation lifecycle; Provider operations and native execution loops are unchanged. Plugin MCP and unconfirmed upstream semantics remain documented gaps.

Validation:

• Complete Core-only make check, SQL/OpenAPI generation, targeted race and real PostgreSQL checks passed.
• Fixed OpenAI SDK 3.13.0 and raw HTTP against independent Core/PostgreSQL/Docker passed with actual Kimi and MiniMax APIs on all three harnesses: Skills, Files/Artifacts, tenant isolation, credential/history protection, cold continuation after source/template deletion, and cancellation. Owned execution resources were cleaned.
• Independent GPT-6 Astra high review of all 60 changed files passed with no material actionable findings. An existing context was reused with explicit user authorization; final documentation status updates were self-checked.

Evidence and limits are recorded in contracts/agents-api/environment-templates.md. This is partial protocol coverage, not complete Environment Templates compatibility.