feat(FN-3077): enforce plugin AI security scan gate across install flows

- Add core plugin AI security scan module and schema support for scan toggle/state metadata
- Enforce scan checks during CLI and dashboard plugin install flows, with preserved API error status on scan failures
- Expose plugin scan toggle and rescan actions in dashboard/plugin manager with route and UI coverage
- Update plugin authoring and CLI/dashboard docs, plus add changeset for published CLI package

Fusion-Task-Id: FN-3077

packages/dashboard/app/components/PluginManager.css

@@ -235,6 +235,52 @@
   flex: 1;
 }
 
+.plugin-security-row {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: var(--space-sm);
+  flex-wrap: wrap;
+}
+
+.plugin-security-results {
+  display: flex;
+  flex-direction: column;
+  gap: var(--space-sm);
+}
+
+.plugin-security-header {
+  display: flex;
+  gap: var(--space-sm);
+  align-items: center;
+}
+
+.plugin-security-summary {
+  margin: 0;
+}
+
+.plugin-security-badge {
+  font-weight: 700;
+}
+
+.plugin-security-badge--warning,
+.plugin-security-badge--unavailable {
+  color: var(--color-warning);
+}
+
+.plugin-security-badge--blocked,
+.plugin-security-badge--error {
+  color: var(--color-error);
+}
+
+.plugin-security-findings {
+  margin: 0;
+  padding-inline-start: var(--space-lg);
+  display: flex;
+  flex-direction: column;
+  gap: var(--space-xs);
+}
+
 .plugin-detail-actions {
   display: flex;
   gap: var(--space-sm);
@@ -540,6 +586,10 @@
     justify-content: center;
   }
 
+  .plugin-security-row {
+    align-items: flex-start;
+  }
+
   .plugin-detail-actions {
     flex-wrap: wrap;
     justify-content: flex-start;