fix(plugin): clean orphaned legacy engineer payloads

[kaitranntt]

Closes #925

Root cause

Plugin install-mode detection relied on metadata ownership history. After that ownership was pruned, restored flat Engineer files became invisible even when they were byte-identical to files from a known ClaudeKit plugin cache, allowing stale copied payloads to coexist with plugin mode.

Summary

• recover orphan ownership only from official ck cache manifests with matching versions and exact same-path bytes
• reject modified, custom, path-escaping, and symlinked files; revalidate proof immediately before backup and removal
• route metadata-free and malformed-metadata installs through the existing doctor/update repair flow
• isolate update tests from the machine's installed Codex plugin state

Test plan

• bun run ci:local (5,326 pass, 65 skip, 0 fail)
• affected plugin/update suite (172 pass, 0 fail)
• pre-push gate, including packaged CLI verification and UI suite (153 pass)
• staged and remote-commit Gitleaks scans

Docs impact: none — internal repair and safety behavior; commands unchanged.

[kaitranntt]

Maintainer review\n\nSummary: Repairs metadata-pruned legacy Engineer payloads using official cache provenance and exact same-path byte matches, then routes the result through existing convergence.\n\nRisk: Medium scope, low residual risk.\n\nMandatory gates\n- Duplicate/prior implementation: clear; #891 and #911 are predecessor work, not duplicates.\n- Project standards: followed.\n- Strategic necessity: clear reliability and support-toil reduction.\n\nFindings: No Critical or Important findings.\n\nValidation: 172 focused tests passed; full local CI passed with 5,326 tests and 65 skips; typecheck, lint, builds, package verification, Gitleaks, and all three GitHub checks passed. PR is mergeable and CLEAN against .\n\nVerdict: Approve.\n\nPosted by /ck:review-pr at 2026-07-14T06:20:00Z

[kaitranntt]

Review correction: PR is mergeable and CLEAN against dev.