[deploy-plugin DPB-15] plugins/deploy: manifest triad, descriptor composition root, verify-plugin

[rickylabs]

Part of #892 (RFC #891; corpus .llm/runs/plan-deploy-plugin--seed/ r5).

The A5 plugin: protocol-valid tooling installer manifest; DeployTargetContribution descriptors resolved from the generated registry module — the plugin depends on core only, with per-target permission profiles; doctor deploy-target check (states incl. adapter-not-installed/credential-unavailable; reports orphaned declarations); verify-plugin.ts green. Anti-scope: no static adapter imports; no HTTP service in v1 (DP-4 §1–§3, SF-12).

Acceptance

• gate: missing-peer / invalid-export / duplicate-key / uninstall / stale-registry tests
• gate: verify-plugin passes with the declared axes
• gate: the plugin imports core only (import-graph)

Metadata

Dependencies: DPB-5, DPB-9, DPB-10, DPB-12, DPB-14
Delivery shape: thin A5 plugin