fix(plugin): warn instead of silently dropping an installed plugin with a bad manifest

[acamarata]

Symptom

$ nself plugin install notifications
Plugin "notifications" installed successfully.

$ nself plugin list --installed
audit-log            [installed]
feature-flags        [installed]
jobs                 [installed]
search               [installed]
storage              [installed]
tokens               [installed]
webhooks             [installed]

Eight plugins installed, seven listed. No warning, no error, nothing on stderr. From the user's side that is indistinguishable from never having installed it — and the directory and manifest are on disk.

Found while running the Task Bundle clean-install proof for P6-E4-W2-S2-T4, in an isolated HOME so no pre-existing machine state was involved.

Cause

listInstalled() skipped any directory whose plugin.json failed to parse:

m, err := parseManifest(manifestPath)
if err != nil {
    continue // skip directories without valid manifests
}

That comment is right for a stray directory. But a directory under the plugin root is an installed plugin — a manifest that won't parse is a defect to report, not a reason to pretend the plugin is absent.

Why that manifest fails to parse

plugins/free/notifications/plugin.json declares "status": "deprecated" but carries the flat deprecated / deprecatedSince / deprecated_in / replacedBy fields instead of the deprecation block validateManifest requires (announcedDate, eolDate, migrationGuide). It is the only free plugin in that state.

It is also one of the eight plugins in the free Task Bundle — so the flagship free bundle installs eight and lists seven.

The manifest itself needs fixing in nself-org/plugins (separate PR). This change is what makes that whole class of defect visible instead of silent.

The change

Still a continue — one bad manifest must not hide the other seven. It is now a visible diagnostic naming the directory and the parse error.

Output follows this package's existing convention: fmt.Fprintf(os.Stderr, "warning: ..."), identical in shape to download.go:283. internal/plugin deliberately imports internal/ui nowhere, and this is a low-level diagnostic rather than command output.

Tests

Test	Asserts
TestListInstalled_InvalidManifestIsSkippedButWarned	reproduces the exact broken shape; valid neighbour still listed and stderr names the offending directory
TestListInstalled_ValidDeprecatedManifestIsListed	the real remedy — with a proper deprecation block it parses and lists normally

Verification

• Both new tests pass; go test ./internal/plugin/ -count=1 → ok
• go vet clean, gofmt -l clean, go build ./... exits 0
• Negative case proved: deleting the warning and re-running fails the first test with exactly the "would disappear silently" message, then passes again when restored

No gate weakened — this surfaces a failure that was being swallowed.