feat: harden plugin api for separate repos, signed updates and generic external login

plugins/ai/manifest.json

@@ -24,7 +24,8 @@
     "network:outbound",
     "notify:send",
     "network:serve",
-    "ui:surface"
+    "ui:surface",
+    "users:impersonate"
   ],
   "optionalDependencies": {
     "workspaces": "^1.0.0",
@@ -185,7 +186,8 @@
           }
         ]
       }
-    }
+    },
+    "uses": ["terminal.sidePanel", "terminal.toolbar"]
   },
   "locales": "locales",
   "platforms": ["linux", "win32", "darwin"]