e2e: cover built-in plugin package management

[codeaholicguy]

Current coverage

No E2E invokes the built-in plugin add, plugin list, or plugin remove commands. Plugin-contributed commands such as task and memory-dashboard remain out of scope.

What is missing

• Install and enable a local packed plugin in an isolated global npm root
• Empty and configured list output
• Disable and uninstall behavior
• Malformed manifest, missing entrypoint, built-in command conflict, and install/uninstall failure
• Corrupt/missing installed package state
• Confirmation that contributed command code is not needed for these management assertions

Risk ranking

Medium-low, rank 13: plugin management changes global CLI behavior and workspace-hoisted tests do not prove published package composition.

Recommended E2E tests

• Redirect HOME/npm cache to temp paths, install a local packed fixture plugin, assert list/remove, and validate malformed/conflicting manifests without executing contributed commands.

Acceptance criteria

• The checklist tests are merged under e2e/.
• No task-manager or memory-dashboard contributed command behavior is tested.
• Tests are offline and leave the real global npm configuration untouched.

Related audit findings

B5 and A10: clean package-boundary compatibility checks and version skew.