fix(plugin): resolve local package manifest entrypoints

[caniko]

Issue for this PR

Addresses #52300 (local package-directory manifest entrypoint discovery). Direct file-path configuration is unchanged; that separate part of the issue is not claimed fixed.

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

Resolve local plugin directories through their package manifest before asking the runtime to resolve the resulting entrypoint. Packages using main: dist/index.js or conditional exports then load when configured by their directory.

Use resolve.exports@2.0.3 for conditional maps. Respect deliberately unexported server/TUI/RPC files, reread manifests during reload, and retain the configuration layer's real-path containment checks. No API contract changes or generated client edits.

How did you verify your code works?

Prior verification for candidate 5e7a5194045ed39589779bd8a7160dadb18cb071, baseline 5183ea45c39aaabf14236d0ce8ae0b086d9c31e8:

• bun run check: all 36 tasks passed in a bounded 10 GiB scope.
• Plugin package tests: 14 passed.
• Focused core supervisor reload/containment tests passed through the package's isolated test runner.
• Built the single-platform CLI with --skip-install --skip-web-ui. Independently packed/installed Claude and Jev plugins loaded directly from their package directories and passed direct/routed shared-backend streaming, concurrent-project reload and real read-tool continuation fixtures.

These are the original candidate's offline receipts, not current-live-target hosted acceptance. Native fork check/test runs 37781818149 / 37781824801 at the unchanged head are still queued without assigned Blacksmith runners; no application tests ran in those jobs. Upstream runs 37674316679, 37674316670 and 37674316719 require maintainer approval. Current full-candidate native Codex review and required application CI remain outstanding; standards/compliance success does not replace them. Actual subscription inference is outside the offline tests. No local tests or builds were run during this maintenance pass.

Screenshots / recordings

Not applicable: package loading change with no UI changes.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

[github-actions]

Thanks for your contribution!

This PR doesn't have a linked issue. All PRs must reference an existing issue.

Please:

1. Open an issue describing the bug/feature (if one doesn't exist)
2. Add Fixes #<number> or Closes #<number> to this PR description

See CONTRIBUTING.md for details.

[github-actions]

The following comment was made by an LLM, it may be inaccurate:

[caniko]

@codex review

Please review the complete PR candidate at head 5e7a5194045ed39589779bd8a7160dadb18cb071 against current v2 93afa91904022f3f6849ada78918407fe90e795d, including all still-actionable historical findings. This is a full-candidate code review request, not a security-only review.

[github-actions]

Thanks for updating your PR! It now meets our contributing guidelines. 👍

[caniko]

@codex review

Please review the complete candidate 5e7a5194045ed39589779bd8a7160dadb18cb071 against current v2 434f7b2a3670dd932794688bee5e34029e546630, including historical findings. This is full-candidate code review, not security-only. Both candidates apply without conflicts to this live target; required application CI and maintainer approval remain separate gates.

[caniko]

@codex review

Please review the complete candidate 5e7a5194045ed39589779bd8a7160dadb18cb071 against current v2 5e73d5cb1f788637b1b3d5cf1298ea694cbad0c5, including all historical findings. The target changed since the earlier request; the unchanged candidate remains conflict-free at this exact comparison. This is a full-candidate code review, not security-only or latest-commit-only.

Existing native fork check/test runs remain queued on their configured Blacksmith runners, and upstream workflow approval remain separate merge gates. No queued run, merge-tree compatibility, draft/readiness marker or supplementary CLI review is being claimed as code acceptance.

Pending request scope amended for target movement; no additional review request was submitted. The complete unchanged-head comparison remains the scope.