feat(sdk,plugins): ajoute capability tooling et services runtime publics (workspace/terminal/tasks)

- capability manifeste tooling supportée backend + transport runtime catalog
- ctx.services publique côté SDK/runtime, gated par tooling
- surface honnête: workspace, terminal, et tasks en observation/contrôle uniquement
- docs/exemple/tests mis à jour
- QA PASS sur feature/sdk-plugin-tooling-build-debug-surface

crates/app-tauri/tests/dto_plugins.rs

@@ -2,7 +2,7 @@ use app_tauri_lib::dto::{
     PluginAdminDto, PluginContributionSummaryDto, PluginRuntimeContributionCatalogDto,
     PluginRuntimePluginDto,
 };
-use domain::{PluginContributionSet, PluginLifecycleState, PluginTrustLevel};
+use domain::{PluginCapability, PluginContributionSet, PluginLifecycleState, PluginTrustLevel};
 
 #[test]
 fn plugin_admin_dto_serialises_exact_contract_shape() {
@@ -48,6 +48,7 @@ fn runtime_catalog_dto_carries_bundle_hash_and_contributions() {
             bundle_url: "idea-plugin://dev.acme.gitgraph/1.2.3/abc/dist/index.js".to_owned(),
             icon_url: None,
             content_hash: "abc".to_owned(),
+            capabilities: vec![PluginCapability::Ui, PluginCapability::Tooling],
             contributes: PluginContributionSet::default(),
         }],
     };
@@ -58,6 +59,10 @@ fn runtime_catalog_dto_carries_bundle_hash_and_contributions() {
         "idea-plugin://dev.acme.gitgraph/1.2.3/abc/dist/index.js"
     );
     assert_eq!(value["plugins"][0]["contentHash"], "abc");
+    assert_eq!(
+        value["plugins"][0]["capabilities"],
+        serde_json::json!(["ui", "tooling"])
+    );
     assert!(value["plugins"][0]["contributes"]["menus"]
         .as_array()
         .unwrap()