[devtools W1d] make plugin manifests forward-compatible before pointer fields

[rickylabs]

Authority: RFC 0005 — DevTools contribution architecture (merged on main).
Planning record: .llm/runs/plan-devtools-contribution--seed/. Ratified by the owner 2026-08-11.

Part of #400

Context

RFC 0005 §15.1 fork F-3 and plan.md risk R5 record drift D-6: #890's claim that "older
CLIs ignore an unknown block" is false — the manifest schema is .strict(), so an unknown key
hard-rejects and the plugin fails to parse. plan.md's rework audit classifies F-3 as
MUST RESOLVE — would force rework, because the .passthrough()-vs-schemaVersion: 2 choice has
different old-CLI behavior and different tests, and it blocks the pointer and emitter slices.
The decision brief also notes this is a live defect in #890/#922's own plan (slice #929 is built
on it), surfaced by this run and escalated — it is not ours to fix unilaterally.

Scope

Files / roots, verbatim from RFC 0005 §14:

• packages/plugin/src/protocol/manifest.ts

Introduces (verbatim): the chosen compatibility contract (.passthrough()/catchall or
schemaVersion: 2).

Out of scope

• Adding the DevTools contribution pointer to the manifest — this slice only makes an unknown block
  survivable; the pointer rides a later slice.
• Reopening the pointer-axis decision (L4, RFC 0005 §4/§6) or inventing a second SDK extension
  mechanism alongside PR RFC: Typed SDK client contributions #1390 (plan.md Non-Scope).
• Any change to Epic: Frontend contribution layer — plugins that ship UI #922's children, which are explicitly untouched (supersession map, fork F-10).

Acceptance

• Fork F-3 is ratified by the owner and the chosen option (.passthrough()/catchall or
  schemaVersion: 2) is recorded in the issue before implementation starts.
• packages/plugin/src/protocol/manifest.ts implements exactly the ratified option.
• The RFC 0005 §14 proving gate passes: a contract test in which an older-CLI parse of a
  manifest carrying an unknown block does not hard-reject — exit code 0, test name linked in
  the PR.
• A test asserts the pre-change behavior is the one described in drift D-6 (unknown key
  hard-rejects), so the fix is proven against a reproduced defect rather than asserted.
• deno task check, deno task test, deno task quality:scan, and deno task arch:check
  scoped to packages/plugin exit 0.
• The finding is cross-referenced to RFC: Frontend Contribution Layer — plugins that ship UI (dashboard · auth · ai · deploy) #890/Epic: Frontend contribution layer — plugins that ship UI #922 so their slice [frontend-contrib S7] @netscript/plugin pointer axis (.withFrontend) #929 is not built on the false
  assumption (comment only; no re-scoping of another epic's children).

Dependencies

• BLOCKED on owner fork F-3 (RFC 0005 §15.1). The unblocking decision is:
  "Manifest schema-evolution precondition — land it before any manifest-visible pointer", and
  specifically which compatibility contract is chosen. Until the owner selects
  .passthrough()/catchall or schemaVersion: 2, this slice has no implementable contract and
  stays at status:triage.
• Depends on: fork F-3 ratification (RFC 0005 §14 lists fork F-3 as this slice's dependency, not
  another slice).
• Blocks: W2-a, and every manifest-visible pointer slice.