feat: run plugin install scripts

[sheepbox8646]

Summary

• Add the plugin manifest install field with string/list parsing and normalized SDK/OpenAPI output.
• Change Supermarket plugin install order to fetch trusted manifest, extract the bundle, run install commands from /data/.memoh/plugins/<plugin_id>, then create DB/MCP installation records.
• Inject only MEMOH_PLUGIN_ID, MEMOH_PLUGIN_DIR, and MEMOH_BOT_ID; command failure now fails the API before DB/MCP plugin creation.
• Return install_scripts metadata on successful installs with command count, exit code, and truncated stdout/stderr.

Validation

• mise run sdk-generate
• TMPDIR=/tmp go test ./internal/plugins ./internal/handlers ./internal/skills ./internal/hooks ./cmd/agent
• pnpm --filter @memohai/web build
• TMPDIR=/tmp git commit -m "feat: run plugin install scripts" (pre-commit Go lint/tests)

Related: memohai/supermarket#14