[SizzleUnrlsd]

Summary

Implements the plugin infrastructure of docs/architecture.md (§13 Plugin API, §14 Plugin Manifests, §23 Findings, §32 Stable API, §33 Versioning, §34 Plugin Isolation).

• Acceptance tests first (test: define plugin API, manifest and loader behavior), implementation follows in this PR.
• coretrace_python.plugins: Plugin base class with declarative requires and analyze(ctx), a PluginContext that only serves declared analyses and exposes module and functions(), run_plugins sharing one AnalysisManager across plugins.
• coretrace_python.findings: immutable Finding with lightweight fields (rule, message, severity, confidence, span, function, metadata) and a schema version.
• Manifests: plugin.toml with name, version, plugin_api compatibility range, requires, provides, entrypoint. Parsed with the standard library tomllib; TOML instead of the YAML shown in the document to avoid a runtime dependency.
• Loader and registry: in-process, checks the API range, the entrypoint, registered analysis names and that manifest requires match the class.
• Reference plugin plugins/syntax/dangerous_eval: reports calls resolving to python.builtins.eval / exec through SymbolAnalysis, so aliases and shadowing do not fool it.

Not in this PR: the stable accessors that need later phases (cfg, taint, abstract_value, ...), the specialised plugin base classes of §13, out-of-process isolation, and CLI reporting of findings (Phase 5 reporters).

Closes #9

🤖 Generated with Claude Code