Phase 5.6B: Composer plugin metadata discovery

[josiahking]

Summary

• adds explicit Composer installed.json plugin metadata discovery
• preserves Composer package name as the authoritative plugin identifier
• validates schema-1 plugin and component-graph metadata strictly
• keeps enablement explicit and separate from discovery
• performs no discovery-time entry-point validation or instantiation
• rejects malformed object/list/null metadata shapes deterministically

Validation

• PHPUnit: 481 tests / 1948 assertions
• Architecture + Documentation: 193 tests / 7439 assertions
• PHPStan: clean
• PHP-CS-Fixer: clean
• release validation: passed
• prerelease consumer validation: passed
• package split validation: deterministic/tree/inventory equality passed
• Plugin split changed; Contracts/Core/Module/HTTP/Testing remained unchanged

Scope

11 paths:

• 7 added
• 4 modified
• 0 deleted

Phase 5.7 Testing SDK and package acceptance remain deferred.