fix(plugin): manifest-probe sandbox + tempdir cleanup + deterministic tarball extract

Closes three audit gaps along the install/discovery surface:

#10 - fetch_manifest at discovery.rs was using a bare Command with no
timeout, no env_clear(), no stdout cap. A plugin that hung on stdin or
spewed gigabytes wedged `animus plugin list` and exhausted memory.
Now uses tokio::process::Command with kill_on_drop, 5s timeout, 1MiB
stdout cap (mirror cap on stderr), and the same PLUGIN_BASE_ENV_ALLOWLIST
as full plugin spawns. Kept the entry point sync (callers are sync but
some live inside an async runtime) by running the probe on a dedicated
worker thread with its own current-thread tokio runtime - no caller
refactoring required.

#13 - Plugin install was creating std::env::temp_dir().join(uuid)
tempdirs and never cleaning them up. Year of weekly installs = GBs
of leftover staging dirs. Both call sites (URL install in
fetch_url_to_temp and release install in resolve_release_install)
now go through create_install_staging_dir() which returns a
tempfile::TempDir RAII guard. The ReleaseInstall struct holds its
TempDir until run_plugin_install drops it after the binary has been
copied to ~/.animus/plugins/.

#16 - extract_tarball was returning the first file from a walk-order
iteration. Tarballs with README + LICENSE + binary were installing
the README and failing later with an unhelpful manifest probe error.
Now prefers basename matching the expected plugin name (passed down
from the install spec - the GitHub repo basename), falls back to the
only executable file, errors clearly listing every extracted file
when ambiguous.

9 new tests:
- 3 manifest-probe sandbox tests (timeout fires + kills child,
  stdout cap fires + kills child, env scrubbed during probe)
- 2 tempdir cleanup tests (RAII drop on success, RAII drop on
  early-return failure)
- 3 tarball selection tests (basename match wins, sole executable
  fallback, ambiguous content errors clearly)
- existing extract_tarball test updated to pass the new expected_name
  parameter

Author: Shooksie