V2 plugin npm install can hang the session startup with no timeout #41934

Summary

In V2, loading a plugin referenced by an npm specifier (e.g. "some-plugin@latest" in experimental.plugins) calls Npm.add → Arborist reify() with no timeout and no retry (packages/util/src/npm.ts). With a cold cache and a slow or wedged registry, the install can hang indefinitely, blocking the session/startup path that awaits the plugin load. The user sees the operation stuck in retries for a very long time before it eventually succeeds (or never).

This is the same unguarded-install mechanism as V1 issues #31463 (still open) and #33905 (closed as a mis-triage — the mechanism was left untracked; see the comment by willmcginnis). V2 inherits the same gap in PluginSupervisor.load (packages/core/src/plugin/supervisor.ts), which awaits npm.add(...) and the subsequent dynamic import with no bound.

Environment

• opencode version: V2 (next)
• OS: macOS
• Install/channel: next

Reproduction

1. With a cold ~/.cache/opencode/packages/ cache, add an npm-specifier plugin to the config
2. Slow down or wedge the npm registry (throttled network works)
3. Start a session that loads the plugin
4. The install neither fails nor completes within a bounded time; the path awaiting npm.add stays blocked

Expected behavior

• The install is bounded by a configurable timeout (npm itself defaults to a 300s fetch timeout)
• On timeout, the failure is surfaced with the package name and install directory instead of a silent hang
• (Follow-up: bounded retry for transient registry errors, per [FEATURE]: add OPENCODE_DISABLE_INSTALL env var to skip npm installs at startup #37888 the option to skip installs entirely)

Related: #31463, #33905, #37888, #25293