Enforce bash plugin SHA256 verification as a hard error

[santosr2]

Summary

Bash plugin checksum verification is currently warn-only. When a bash rule's SHA256 does not match its manifest, the loader logs a warning and loads the script anyway. This should become a hard error so users can rely on integrity verification.

Current state

• internal/plugins/bash_loader.go:14-19: on checksum mismatch, loadAndRegisterBashRule logs [WARN] ... (loading anyway - warn-only mode) and continues.
• The rule is dispatched from internal/plugins/plugin.go:298-299 (case strings.HasSuffix(name, ".sh")), which calls loadAndRegisterBashRule (bash_loader.go:12).
• Net effect: a tampered or stale bash plugin still loads.

Scope

• bash_loader.go carries //go:build !windows, so this only applies to non-Windows builds.

Goal

Switch the warn-only branch to return an error, so a checksum mismatch blocks the plugin from loading.

Migration path

1. Announce the behavior change in release notes.
2. Bump the minor version.
3. Flip the warn -> error switch at bash_loader.go:14-19.

Blockers

• All example bash rules must ship with valid manifests before enforcement (already addressed: the examples/bash-rule manifest is regenerated and current).