Harden plugin scripts and add latest-stable

[RobLoach]

Hardens the plugin's bin scripts and adds a proper latest-stable resolver.

• install/download: add set -euo pipefail and quote positional args so a failed emsdk install no longer lets activate run, and paths with spaces work.
• exec-env: pick the bundled node deterministically via a quoted glob instead of for DIR in $(ls ...).
• latest-stable: new bin/latest-stable so asdf latest emsdk resolves the highest stable tag (supports a version-series query).
• list-all: escape the version regex ([0-9]+\.[0-9]+\.[0-9]+) so dots match literally.
• README: replace the deprecated shields workflow/status badge with the current actions/workflow/status endpoint.