feat(plugin): install the pipelines' skill plugins on SessionStart

The ship-feature pipelines drive `/superpowers:*` commands as their per-node
drivers, so a fresh install had a dependency it was only told about — the
`/ccam-doctor` WARN row and a line in the README.

`server/lib/skill-plugins.js` now carries the whole thing, shared by the
doctor (reports) and the bootstrap (installs) so the two cannot disagree
about what is missing. The bootstrap installs at the very end of its DETACHED
worker — the install clones from the network and nothing in the 10 s
SessionStart hook may wait on it — retrying once behind a `marketplace add`,
logging a failure with the manual command, and never throwing: the dashboard,
hooks, CLI and MCP all work without these plugins. The outcome is recorded as
`state.skillPluginsSettled`, which `fastPathOk()` now also requires, so the
check runs exactly once per install and `/ccam-update` is the retry.
`CCAM_AUTO_INSTALL_PLUGINS=0|false|off` opts out.

Reporting is derived, installing is allowlisted. Requirements come from the
loaded templates, which is right for a report; installing from that same
source would not be, because a template is a file anyone can drop into
`DASHBOARD_PIPELINES_DIR` — it would turn "edit a JSON file" into "run this
vendor's install command on the next session". Auto-install consults
`AUTO_INSTALLABLE`, a constant in code (`superpowers` today), and reports
every other requirement as skipped.

Tests inject a `run` seam so no case reaches a real `claude plugin install`,
and cover the refusal explicitly.

ARCHITECTURE.md

@@ -1113,7 +1113,15 @@ install into `~/.claude/agent-dashboard/runtime/`, the `~/.local/bin/ccam`
 launcher, and the detached server spawn with `NODE_PATH` and
 `DASHBOARD_CLIENT_DIST` pointed at that runtime directory. It never writes into
 the plugin cache, which Claude Code garbage-collects and replaces on every
-update. Full behavior: [`docs/PLUGINS.md`](docs/PLUGINS.md).
+update.
+
+Last in that worker — deliberately, because it clones from the network and
+nothing above it may wait — it installs the plugins the pipeline templates drive
+(`superpowers`) via `server/lib/skill-plugins.js`, the same module
+`/ccam-doctor`'s `Skill plugins` row reports from. The report is derived from
+the templates; the install consults a fixed allowlist in that file instead,
+because a template is user-writable. Full behavior:
+[`docs/PLUGINS.md`](docs/PLUGINS.md).
 
 ---