refactor(core): tidy plugin host and config reload wiring - #61176

Problem

The plugin host and a couple of config plugins had the same code copied in a few places, so a fix to one copy could easily miss the others.

Change

I pulled each repeat into one place. Behavior should be the same.

 config/plugin/entry-observer.ts
+  observeSources()       # load, watch, debounce, reload (agent + command used to copy this)
+  isDirectorySource()    # replaces isAgentSource / isCommandSource / isPluginSource
 plugin/host.ts
+  atLocation(ref, effect)   # remote agent list and remote mcp.list
+  sessionPermission(input)  # permission.get and permission.reply
+  connectionInfo(conn)      # the 3 Credential.ID brandings
 plugin.ts
+  snapshot()             # the 3 inventory rebuilds
 plugin/internal.ts
+  built-ins come back with revision "internal" and source builtin (was done in supervisor)
 plugin/module.ts
+  source(target, version?)  # supervisor's pluginSource now uses it
 plugin/supervisor.ts
-  inline Failure type    # uses Plugin.Failure

observeSources keeps the old order: it subscribes to config changes and config.updated before the first scan.

Out of scope

• methodImplementation in host.ts: merging the command and external branches, or the env branch with the fallback, doesn't typecheck without casts, so I left them separate.
• The builtin / server: true defaults for duplicate-ID failures in supervisor.ts: there are only two short copies in different modules, and sharing them would need a new export.

Verification

• bun typecheck in packages/core
• bun test test/config test/plugin test/plugin.test.ts test/plugin-failure.test.ts test/model-plugins.test.ts in packages/core: 837 pass
• bun run check from the root