Add external plugin hook registration and worker invocation

[jonathanKingston]

External plugins can now declare and register function hooks through the existing isolated runtime. A hook-only copse-plugin.json can declare runtime.hooks, and its activate(api) can call registerHook({ id, event }, handler) without providing tools or model routes.

The host validates the exact declared registration IDs and canonical events before enabling the plugin. Explicit invokeHook calls travel through the worker protocol with cancellation and error propagation. Handlers receive only { event, signal }; existing API-v1 workers may omit hook registrations.

This is SDK stage 1: hooks load and register, but canonical agent events do not automatically dispatch them yet. Event-specific payload/result validation, result transformations and next() composition remain follow-up work. The SDK guide and binding decision 15 document this boundary.

Validation:

• pnpm run check — typecheck, lint, formatting, dead-code and test-selection guards, E2E syntax, and all 8,561 unit tests passed.
• pnpm run build.
• pnpm run test:e2e --spec tests/e2e/plugin-hook-loading.e2e.ts — passed in real Electron on macOS with production seatbelt, snapshot materialization and the built worker. Verifies loading a hook-only plugin, sibling module/asset reads, disable/re-enable and restoration after relaunch; activation fails unless outside-file reads and workspace/snapshot writes are denied. The selected source is seeded into an isolated profile; the native folder picker is not exercised.
• Real worker integration tests cover invocation, mismatches, cancellation, handler errors and non-serializable results.

Screenshot: enabled hook-only plugin after relaunch.

[copse-release-bot]

Reference screenshots ready for review

Review GitHub’s image diffs in screenshot PR #2601.
Merge it (or enable auto-merge) to apply the accepted PNGs to codex/external-hook-registration.

Rendered for 8217103a86fb by CI run 34299700628; the immutable artifact is reference-screenshot-candidates-34299700628.

If this source branch moves, a later successful render closes the stale review PR and replaces this link.

[github-actions]

🖥️ PR preview

• Marketing site
• Browser demo
  Interactive, with a mocked backend — jump to a scenario:
• Builds a cupcake site
• Agent-proposed edits open the Changes panel
• Markdown list indentation
• Responsive composer footer
• Subagent display visual reference
• Subagent stays ungrouped beside reading tools
• Semantic search subagent markdown
• Light-theme approval with a bright accent
• Light-theme syntax, fills, and selection
• Grouped outside-sandbox command approval
• Remote desktop discovered-port list with one selected
• Settings scroll + sticky footer geometry
• Per-model reasoning / temperature / top-p
• Thread switch hydration notice
• Thread switch hydration failure
• Chat layout styling
  _{Static demo of the renderer against a mock API — the browser pane, terminal, and all main-process IPC are stubbed, so it never proves main-process behaviour. Rebuilt whenever a push changes the demo bundle; these links go live once the queued deploy lands, shortly after this comment. Removed when the PR closes.}