Closes#2408
Plugin run targets were static argv wrappers: a plugin couldn't refuse a built-in Run/Test/Debug launch through its target (for example when its container project is stopped), so the wrapper started and could start the environment as a side effect. API 1.5 adds an optional run-target-validation export: after trust, ownership, process-grant and pin checks the host calls validate with the operation, bare program name and working directory; an error refuses the launch with the plugin's (prefixed, bounded) message and keeps the selected target. Plugins without the export behave as before. Calls wake reclaimed instances, use the host call timeout, are cancelled with the launch, and fail closed on trap/timeout; for remote projects validation runs on the server. SDK helpers, plugins/README.md and fixtures updated.
Closes#2407
A run-target command override replaced the wrapper's args but always appended the target's shared workdir-args, so an override like `composer -> [composer]` for DDEV produced `ddev composer --dir=... -- install` and fed exec flags to Composer. API 1.5 adds register-with-overrides, whose command overrides carry optional workdir-args: none inherits the shared list, an empty list omits it, and a list replaces it with the same {cwd} mapping and argv/path bounds. API 1.4 registrations map onto it unchanged; trust, process grants, pinning, remote execution and debugging go through the same path. SDK, plugins/README.md and fixtures updated.
Plugin API 1.4: grants for unencrypted HTTP, local sockets, IDE commands and owned database sources; window status items, output channels, content tabs, editor selections, decorations, search, Problems and VCS reads; runs, keyed terminals with exit events, plugin run targets, dynamic run configurations and test parsers; language features, injections, snippets and menu locations; plugin MCP tools on the built-in server; four official API examples. Released 1.3 plugins keep working.
l0ng-ai