feat(plugin): install the pipelines' skill plugins on SessionStart

The ship-feature pipelines drive `/superpowers:*` commands as their per-node
drivers, so a fresh install had a dependency it was only told about — the
`/ccam-doctor` WARN row and a line in the README.

`server/lib/skill-plugins.js` now carries the whole thing, shared by the
doctor (reports) and the bootstrap (installs) so the two cannot disagree
about what is missing. The bootstrap installs at the very end of its DETACHED
worker — the install clones from the network and nothing in the 10 s
SessionStart hook may wait on it — retrying once behind a `marketplace add`,
logging a failure with the manual command, and never throwing: the dashboard,
hooks, CLI and MCP all work without these plugins. The outcome is recorded as
`state.skillPluginsSettled`, which `fastPathOk()` now also requires, so the
check runs exactly once per install and `/ccam-update` is the retry.
`CCAM_AUTO_INSTALL_PLUGINS=0|false|off` opts out.

Reporting is derived, installing is allowlisted. Requirements come from the
loaded templates, which is right for a report; installing from that same
source would not be, because a template is a file anyone can drop into
`DASHBOARD_PIPELINES_DIR` — it would turn "edit a JSON file" into "run this
vendor's install command on the next session". Auto-install consults
`AUTO_INSTALLABLE`, a constant in code (`superpowers` today), and reports
every other requirement as skipped.

Tests inject a `run` seam so no case reaches a real `claude plugin install`,
and cover the refusal explicitly.

plugins/ccam/commands/ccam-doctor.md

@@ -24,7 +24,10 @@ Print the output verbatim, then add at most three lines of guidance based on the
 - `WARN ccam CLI` → print the exact `export PATH=...` line from the output.
 - `WARN Skill plugins` → the pipelines name slash commands no installed plugin
   provides. The dashboard is unaffected; `/ccam:ship-feature(-lane)` is what
-  stops partway. Print the `claude plugin install …` line from the output.
+  stops partway. The bootstrap normally installs these itself, so this row also
+  means that attempt has not run or did not succeed — say `/ccam-update` retries
+  it, and print the `claude plugin install …` line from the output as the manual
+  route.
 - `WARN Dashboard UI` → run `/ccam-open` to build the bundle.
 
 No preamble, no summary of things that passed.