feat(FN-3077): enforce plugin AI security scan gate across install flows

- Add core plugin AI security scan module and schema support for scan toggle/state metadata
- Enforce scan checks during CLI and dashboard plugin install flows, with preserved API error status on scan failures
- Expose plugin scan toggle and rescan actions in dashboard/plugin manager with route and UI coverage
- Update plugin authoring and CLI/dashboard docs, plus add changeset for published CLI package

Fusion-Task-Id: FN-3077

packages/core/src/db.ts

@@ -88,7 +88,7 @@ export function probeFts5(db: DatabaseSync): boolean {
 
 // ── Schema Definition ────────────────────────────────────────────────
 
-const SCHEMA_VERSION = 65;
+const SCHEMA_VERSION = 66;
 
 function normalizeTaskComments(
   steeringComments: SteeringComment[] | undefined,
@@ -654,6 +654,8 @@ CREATE TABLE IF NOT EXISTS plugins (
   settingsSchema TEXT,
   error TEXT,
   dependencies TEXT DEFAULT '[]',
+  aiScanOnLoad INTEGER NOT NULL DEFAULT 0,
+  lastSecurityScan TEXT,
   createdAt TEXT NOT NULL,
   updatedAt TEXT NOT NULL
 );
@@ -1699,6 +1701,8 @@ export class Database {
             settingsSchema TEXT,
             error TEXT,
             dependencies TEXT DEFAULT '[]',
+            aiScanOnLoad INTEGER NOT NULL DEFAULT 0,
+            lastSecurityScan TEXT,
             createdAt TEXT NOT NULL,
             updatedAt TEXT NOT NULL
           )
@@ -2771,6 +2775,13 @@ export class Database {
       });
     }
 
+    if (version < 66) {
+      this.applyMigration(66, () => {
+        this.addColumnIfMissing("plugins", "aiScanOnLoad", "INTEGER NOT NULL DEFAULT 0");
+        this.addColumnIfMissing("plugins", "lastSecurityScan", "TEXT");
+      });
+    }
+
   }
 
   /**