feat(plugins): add client remote and product events

[xxhZs]

Summary

• add a typed Host-side Client Remote registry with profile/session scoping, schema validation, lifecycle retirement, and abort propagation
• expose generation- and session-fenced unary calls plus connection-owned pull streams through Runtime Host, Desktop IPC, preload, and the Client Runtime
• add an explicit product-event allowlist for Session, Agent Graph, and Tool activity with subscriptions owned by the active Client plugin generation
• document the PR3 contract, limits, lifecycle, and extension points

Stack

Depends on #5303 (Client Runtime + typed recursive UI Slots). This branch is stacked on its current head; the PR diff will collapse to PR3-only changes after #5303 merges.

Verification

• Core, Runtime, Runtime Host, UI, and Desktop typechecks
• Desktop production build
• PR3 Runtime/UI/Runtime Host/Desktop focused tests
• Runtime Host plugin platform tests: 47/47
• full Runtime Host suite: 1940 passed, 12 skipped
• CLI suite: 1047 passed, 3 skipped
• Biome lint and format checks
• ASF header, Astryx inventory, renderer architecture, and model metadata checks

The full parallel workspace runner exposed an existing Node 24 SQLite ExperimentalWarning sensitivity in one unchanged Storage child-process test; that test passes 5/5 when the inherited warning is suppressed. A separate CLI rerun also passes 1050/1050 counted outcomes (including skips).

[xxhZs]

Closing this stacked PR because its commit has been folded into #5303 as requested.