[DanielNetzer]

Implements issue #298.

Molecule: mol-298-957d032b97848b7331332aa2
Formula: forgecell-github-issue
Base: 8b0a3cb561abafe129e04da177a056cde4a9b39f
Delivery: 8527eeecc9cf17a70d61af5f4cfbb3a8a19e1df2

Awaiting exact-commit CI and human review. Harness-reported checks are not independent CI evidence. No merge, deployment or issue closure is authorized.

[DanielNetzer]

Adversarial review (plugins slice 2b-1): no HIGH findings. I checked:

• that Formulas without the new keys keep the same f.YAML, SHA256 and learning fingerprint;
• that init- and demo-written Formulas (source: github-issues, via: github) pass the legacy checks;
• that manifest paths reuse the extension path rules, digests are lowercase only, and duplicate YAML keys are refused;
• that non-string keys are refused before json.Marshal, config depth is at most 32, and config size is at most 4 KiB;
• that plugin list prints no path, starts no process, refuses symlinks, encodes an empty list as [], and returns the specified exit codes.

Fixed in this PR, with one verify pass:

1. Correctness: YAML decodes a mapping with any non-string key (1:, ~:, true:) as map[any]any, which skipped the intake.source and intake.config checks entirely. Such an intake block is now refused.
2. plugin list now says "the active Formula could not be loaded" instead of pointing at init when the Formula fails to load.

By-design base-test change: the base TestPluginTestUsage used plugin list as its unknown-subcommand example, which is now a real subcommand. It is declared as an expected protected delta (Issue clarification, option b).

Behaviour change worth noting: Parse used to ignore top-level plugins, forge and reviewers and accept any intake.source. A Formula that uses those keys in other shapes is now refused, with a message that names them.

LOWs:

• Reviewers() returns a shallow copy, so nested config values are shared.
• An unquoted YAML date in config gets the generic "must be JSON-compatible" error instead of a "quote it" hint.

Integration: I applied this branch to current main (with #300 and #302). go vet ./... passes, every package compiles its tests, and go test -timeout 20m ./internal/{formula,cli,plugin,learning,onboarding}/... passes: 1632 tests.

I saw one candidate run fail only on load flakes in untouched packages (plugin/conformance and install), tracked as #303. A checks-only rerun was green.