epic: Plugin SDK readiness — core prerequisites

[MitulShah1]

Tracking epic for the core ai-gateway changes required before the Plugin SDK (v1.5.0) and the ai-gateway-plugins repo can go fully public end-to-end. The plugins themselves live in ferro-labs/ai-gateway-plugins; this epic covers only the gateway-core seam work.

Upstream dependency (v1.4.0)

• feat(run): expose public importable server entrypoint for plugin builder + embedded use #206 — importable run entrypoint (AGW-1 / Embeddable Gateway). Unblocks ferrogw-builder + embedded lanes.

Core prerequisites (this milestone, v1.5.0)

• feat(plugin): streaming-aware stage + optional StreamInspector (additive) #208 — streaming-aware stage + optional StreamInspector (blocks the first streaming guardrail)
• feat(plugin): fixed category ordering + per-category hot-path timeout in Manager #209 — fixed category ordering + per-category hot-path timeout in Manager
• feat(plugin): conformance kit (internal/pluginconformance + public pluginhelper) #210 — plugin conformance kit (internal/pluginconformance + public pluginhelper) — the verified-badge gate
• security(plugin): resolved-config-only — plugins never see the global secret map #211 — resolved-config-only (plugins never see the global secret map)

Already covered

• v1.1.6 ships plugin-pipeline panic recovery / RunOnError-on-reject / Close-on-reload.

Decision record

Architecture is locked (two frozen seams; categories as plugins-repo SDK facades; static-primary / WASM-second; conformance-kit-as-badge-gate). All four items are additive — no break to the frozen plugin / observability v1 surfaces.