core: review fixes, init builds the agent, console without a terminal

Activation path (review T6R): a broken plugin or a stray file in
/plugins blocks no activation; candidates replace their own entries;
discovery has a 10 s deadline and its process is stopped after the
answer; an unchanged hash keeps plugin.prev.wasm; activations run in
their own task; the watcher is not recursive; no duplicate services;
rpc.retired waits for live processes of its version; reads and hashes
on blocking threads.

Guest I/O and per-call paths: a stdin write error is EOF, stdout and
stderr are drained before the status; stderr is lossy UTF-8 and goes
to the journal from its own reader; compiled components are freed;
shutdown starts no new processes; lock queues drop stopping processes;
compile before the admission gate; CommandPre per component;
core.unlock in order; null errors are successes; the journal thread
survives SQLite errors.

sausage init builds the agent with cargo.build; sausage without a
command creates ./world. The console reads plain lines without a
terminal. PROTOCOL.md and DECISIONS.md describe the decided rules. The
flake tests the whole workspace and checks the packaged cargo.build.

cli/tests/plugins/activation/src/main.rs

@@ -41,13 +41,40 @@ fn main() {
         "serve" | "hold" => {
             send(json!({"jsonrpc":"2.0","id":request["id"],"result":{"version":version}}));
             if request["method"] == "serve" {
+                let exclusive = format!("/run/{plugin}-service");
+                if std::fs::OpenOptions::new()
+                    .write(true)
+                    .create_new(true)
+                    .open(&exclusive)
+                    .is_err()
+                {
+                    std::fs::write(format!("/state/{plugin}/duplicate-service"), "duplicate")
+                        .unwrap();
+                }
                 std::fs::write(format!("/state/{plugin}/service"), version).unwrap();
             }
             for _ in lines {}
+            if request["method"] == "serve" {
+                let _ = std::fs::remove_file(format!("/run/{plugin}-service"));
+            }
             std::fs::write(format!("/state/{plugin}/ended-{version}"), "ended").unwrap();
             return;
         }
         _ => json!({"version":version}),
     };
     send(json!({"jsonrpc":"2.0","id":request["id"],"result":result}));
+    if request["method"] == "rpc.discover" && result["x-test-linger"] == true {
+        if result["x-test-stubborn"] == true {
+            while !std::path::Path::new(&format!("/state/{plugin}/discovery-exit")).exists() {
+                std::thread::sleep(std::time::Duration::from_millis(1));
+            }
+        } else {
+            for _ in lines {}
+        }
+        std::fs::write(
+            format!("/state/{plugin}/discovery-ended-{version}"),
+            "ended",
+        )
+        .unwrap();
+    }
 }