fix: stale HookRef in TaskProcessor, and cmf vs. bare compatibility

[tedhabeck]

Summary

This PR addresses a bug in isolated_venv 0.1.x and python compatibility with the CPEX 0.2.x framework (#20)
These changes add support for "bare-FQN" plugins — plugins declared with a Python class path (e.g. pkg.module.ClassName) instead of a standard kind — by auto-converting them to isolated_venv plugins that install their package into the venv without requiring a requirements.txt. Work items are tagged U2/U4/U5/U6/R3 in the code comments.

Changes

• The TaskProcessor instances cached a HookRef which became stale after initialization. The PluginRef is now cached instead, and a fresh HookRef used on each execute_plugin call.
• For compatibility with invocation from CPEX 0.2.0, allow either cmf hook conventions or bare hook names.

Core changes:

• constants.py — Adds plugin-kind constants (native, builtin, wasm, PDP) and a KNOWN_PLUGIN_KINDS frozenset used to distinguish recognized kinds from FQN candidates.
• catalog.py (largest change) —
  • New classify_plugin_kind() / supported_kinds_message() / convert_fqn_kind_in_place(): shape-based detection that buckets a manifest kind into known, FQN (auto-converted to isolated_venv, moving the class path into default_config.class_name), or reject.
  • New _install_package_into_venv() helper consolidating the pip-install-into-venv logic, now reused across the monorepo, PyPI, git, and editable install paths (U4).
  • New _persist_manifest_to_plugin_dir(): writes the converted plugin-manifest.yaml into the plugin dir so the venv cache can hash it.
  • requirements_file is now optional throughout the install paths.
• client.py — Makes requirements_file optional in the venv cache logic and adds a manifest version + content hash as an additional cache-invalidation signal (U5), so FQN plugins without a requirements file still get correct cache busting on version bumps/edits.
• worker.py — Reconstructs the typed PluginPayload from the JSON dict received over stdin before invoking the plugin, fixing an AttributeError where hooks received a raw dict instead of e.g. ToolPreInvokePayload.
• plugin_registry.py — Adds PluginRegistry.get() to look up an installed plugin record by name.
• cli.py — Replaces the naive "already installed → skip" check with a version-aware repeat-install decision (U6): skips only when the target version matches the installed version, otherwise reinstalls (upgrade). Kind-agnostic.

Checks

• make lint passes
• make test passes
• CHANGELOG updated