Add plugin lock-file upgrade

[samuv]

Summary

• Why: Sync restores a pin; teams also need a reviewed path to advance that pin when a mutable source has newer content.
• What:
  • thv ai-plugin upgrade and POST /plugins/upgrade re-resolve each plugins: lock entry's source and install newer content when the digest moved (--preview / --allow-ref-change / --fail-on-changes).
  • Immutable sources (OCI digest or full git commit hash) are reported not-upgradable. Source is never rewritten.
  • A repository move is blocked unless --allow-ref-change is passed. Signer-change guarding is Stack 2 / PR9 — --allow-signer-change is not exposed yet.
  • Preview and --fail-on-changes still fetch OCI artifacts to compare digests (RFC: preview is not side-effect-free) but do not write the lock or install.
  • Gated by TOOLHIVE_PLUGINS_LOCK_ENABLED (403 when off).

Part of #6300. Stack 5/5 — schema → lock-service → install-hooks → sync → upgrade.

Type of change

• New feature

Test plan

• Unit tests (./pkg/plugins/pluginsvc upgrade tests and ./pkg/api/v1 upgrade endpoint tests, with the Taskfile race/ldflags flags)
• Linting (task lint-fix)

Does this introduce a user-facing change?

No by default — the feature is inert unless TOOLHIVE_PLUGINS_LOCK_ENABLED=true. With the gate on, thv ai-plugin upgrade re-resolves plugins: lock entries.

Special notes for reviewers

• No signer-change guard in this PR (PR9). The options type already aliases AllowSignerChange from skills; this PR does not enforce it and does not add the CLI flag.
• resolveLatestState mirrors Install's dispatch (git → OCI → registry name) but stops short of extraction / DB / lock writes.
• Git resolve clones to read HEAD; there is no lighter digest-only primitive, matching skills' "preview is not side-effect-free" note for OCI.

[codecov]

Codecov Report

❌ Patch coverage is 58.40336% with 99 lines in your changes missing coverage. Please review.
✅ Project coverage is 72.94%. Comparing base (2ebd4a8) to head (f5b5f83).

Files with missing lines	Patch %	Lines
pkg/plugins/pluginsvc/upgrade.go	58.50%	60 Missing and 23 partials ⚠️
pkg/plugins/client/client.go	0.00%	12 Missing ⚠️
pkg/api/v1/plugins.go	90.90%	1 Missing and 1 partial ⚠️
pkg/plugins/pluginsvc/install.go	33.33%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@                   Coverage Diff                    @@
##           plugins-lock/04-sync    #6317      +/-   ##
========================================================
- Coverage                 72.95%   72.94%   -0.02%     
========================================================
  Files                       747      748       +1     
  Lines                     78910    79144     +234     
========================================================
+ Hits                      57571    57733     +162     
- Misses                    17263    17307      +44     
- Partials                   4076     4104      +28     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[JAORMX]

Panel review found inconsistent plain-name resolution, ambiguous preview API status, and missing required CLI coverage/completion. Please address the inline findings before merge. The transaction fixes requested on the earlier stack PRs also apply to this upgrade path.

[JAORMX]

Local-store resolution, E2E coverage, and completion were addressed. The local apply path still drops the artifact/reference needed by persisted state and later sync.

[JAORMX]

High — applying a local-store upgrade drops its persisted reference. The local plan keeps latest.layerData but not latest.ref, leaving plan.resolvedRef empty. Apply then passes raw layer data without Reference, and LockResolvedReference becomes empty too; buildInstalledPlugin stores an empty reference and the lock rewrite loses the local tag. Subsequent sync cannot build a pinned reference, and info/upgrade no longer know which local artifact was installed. Carry latest.ref in the plan, pass it as InstallOptions.Reference, and preserve it in the lock (or explicitly retain the previous resolved reference if local tags are intentionally non-restorable). Add DB and lock reference assertions to the local-apply tests.

[samuv]

Fixed. The local-store plan now carries latest.ref and apply sets InstallOptions.Reference so the DB keeps the local tag. The lock cannot store a bare tag: we keep the previous resolvedReference if any, otherwise leave it empty. f5b5f83fa.