FN-6474: clarify plugin tarball install docs

Clarifies packaged external plugin proof-point docs so tarballs are extracted before installation.

- Document that fn plugin install accepts built plugin directories or installed package names, not raw .tgz archives.
- Update external plugin proof-point and authoring guidance to extract pnpm pack output and install ./package.
- Add a static regression test guarding the runbook and authoring guide against raw tarball install instructions.

Files changed:
 docs/cli-reference.md                              |  1 +
 docs/plugins/external-authoring.md                 |  2 +-
 docs/plugins/external-proof-point-runbook.md       | 10 +++++-
 .../external-proof-point-runbook-install.test.ts   | 40 ++++++++++++++++++++++
 4 files changed, 51 insertions(+), 2 deletions(-)

Fusion-Task-Id: FN-6474

Fusion-Task-Lineage: 744d43ff-ed98-43a1-9cb9-e25f96225ab7

docs/cli-reference.md

@@ -1025,6 +1025,7 @@ fn plugin dev <path> [--once] [--ai-scan]
 Subcommands: `list|ls`, `install`, `rescan`, `trust`, `untrust`, `verify`, `uninstall`, `enable`, `disable`, `create`, `new`, `dev`.
 
 Scope semantics:
+- `fn plugin install <path>` accepts a built plugin directory or installed package name, not a packed `.tgz` tarball; extract tarballs before installing.
 - `fn plugin install` / `fn plugin uninstall` are **global** operations
 - `fn plugin enable` / `fn plugin disable` are **project-scoped** operations (`--project` selects the project context)
 - `fn plugin list` shows globally installed plugins plus enabled/disabled state for the current project context