Define versioned plugin API, manifests and loader #9

Plugins hook into the engine through typed interfaces, never through stage callbacks or internal structures.

• PluginContext with module, functions() and get(analysis) restricted to declared requires. Accessors for cfg, calls, taint, abstract_value and source_location arrive with their phases
• One Plugin base class (detectors). Specialised kinds (FrameworkModelPlugin, RefutationPlugin, ReporterPlugin, DependencyPlugin, SecretPlugin, ConfigPlugin, ...) are introduced by the phases that need them
• Plugins declare requires = {SymbolAnalysis, TaintAnalysis, ...} and implement analyze(ctx) -> list[Finding]
• plugin.toml manifest (TOML via stdlib tomllib instead of YAML, no runtime dependency): name, version, plugin_api, requires, provides, entrypoint
• PLUGIN_API_VERSION = 1 and FINDING_SCHEMA_VERSION = 1; manifests declare ranges such as plugin_api = ">=1,<2". PyHIR / PyIR / Summary schema versions come with their persistent formats
• In-process loader and registry; plugins only ever see PluginContext, the seam a future out-of-process host will implement

Reference: docs/architecture.md §13 Plugin API, §14 Plugin Manifests, §32 Stable API, §33 Versioning, §34 Plugin Isolation.

Delivery: #10 (includes the plugins/syntax/dangerous_eval reference plugin)