✨ Require re-confirmation when plugin manifest differs on open

When the fetched manifest differs from the stored manifest (code, name, etc.), show the permissions dialog instead of silently updating — preventing execution of tampered/injected plugins.

On fetch error, show a warning notification instead of loading with the old manifest.

Bundled plugins (no URL) skip validation as they are trusted with no remote source.

Completes the 3-layer defense for T3-N1-02: (1) closed permission schema, (2) dedicated RPC methods, (3) integrity validation on open.

AI-assisted-by: qwen3.7-plus

frontend/src/app/main/data/plugins.cljs

@@ -114,7 +114,7 @@
   [{:keys [url] :as manifest} user-can-edit?]
   (if url
     ;; If the saved manifest has a URL we fetch the manifest to check
-    ;; for updates
+    ;; for updates and validate integrity
     (->> (fetch-manifest url)
          (rx/subs!
           (fn [new-manifest]
@@ -126,6 +126,8 @@
               (cond
                 (and is-edition-plugin? (not user-can-edit?))
                 (st/emit! (ntf/warn (tr "workspace.plugins.error.need-editor")))
+
+                ;; Permissions changed - show permissions dialog
                 (not= (:permissions new-manifest) (:permissions manifest))
                 (modal/show!
                  :plugin-permissions-update
@@ -135,15 +137,25 @@
                      (preg/install-plugin! new-manifest)
                      (load-plugin! new-manifest))})
 
+                ;; Manifest changed (code, name, etc.) - require re-confirmation
+                ;; This prevents execution of tampered/injected plugins
                 (not= new-manifest manifest)
-                (do (preg/install-plugin! new-manifest)
-                    (load-plugin! manifest))
+                (modal/show!
+                 :plugin-permissions-update
+                 {:plugin new-manifest
+                  :on-accept
+                  #(do
+                     (preg/install-plugin! new-manifest)
+                     (load-plugin! new-manifest))})
+
+                ;; Manifests match exactly - safe to load
                 :else
                 (load-plugin! manifest))))
-          (fn []
-            ;; Error fetching the manifest we'll load the plugin with the
-            ;; old manifest
-            (load-plugin! manifest))))
+          (fn [_err]
+            ;; Error fetching the manifest - can't verify integrity
+            ;; Show error instead of loading potentially tampered code
+            (st/emit! (ntf/warn (tr "workspace.plugins.error.unreachable"))))))
+    ;; Bundled plugins (no URL) - trusted, load directly
     (load-plugin! manifest)))
 
 (defn close-plugin!