fix(notifications): add the deprecation block its own status requires, and gate it

[acamarata]

The defect

free/notifications declares "status": "deprecated" but carried only the flat deprecated / deprecatedSince / deprecated_in / removal_target / replacedBy fields.

cli/internal/plugin/manifest.go requires a deprecation object once status is deprecated, so it refused to parse this manifest — and listInstalled() then skipped the directory.

What a user sees:

$ nself plugin install notifications
Plugin "notifications" installed successfully.

$ nself plugin list --installed     # notifications absent
$ nself doctor                      # notifications absent

No warning, no error. It is one of the eight plugins in the free Task Bundle, so that bundle installed eight and listed seven.

It is the only plugin in free/ in this state — I swept the whole tree.

Values are derived, not invented

Field	Value	Source
announcedDate	2026-05-07	the real announcement — commit 6315c5f, "deprecate in favor of notify (S8.T29)"
eolDate	2026-11-07	exactly the 6-month minimum .github/wiki/Deprecation-Policy.md sets for free (MIT) plugins
replacedBy	notify	already asserted by the flat fields
migrationGuide	github.com/nself-org/plugins/wiki/Notify	verified HTTP 200

On that last one: the obvious nself.org/docs/plugins/notify 404s, and nself.org is not currently redeploying. Pointing at it would have satisfied the schema while failing the policy's actual requirement, so I used a URL that resolves today.

The flat fields are left in place — other tooling may read them, and they don't conflict.

Gate added in the same change

The existing "Validate plugin.json files" step checks required fields and never looked at this, which is how the defect shipped. Now any plugin with status: deprecated must carry announcedDate, eolDate and migrationGuide; eolDate must be ≥182 days after announcedDate per policy; and migrationGuide must be an absolute URL.

Reachability is checked too — a definitive 4xx fails, while a network error only prints a note, so a DNS blip cannot make this a flaky gate.

Verification

• The fix works against the real validator: ran the CLI's listInstalled() against a temp dir holding this exact file — notifications now appears.
• Gate proved in all three failing directions, each with its own message and exit 1:
  1. block removed (the shipped defect)
  2. notice period shortened to 30 days → "requires at least 182 (6 months)"
  3. migrationGuide pointed at the 404ing nself.org URL → "returned HTTP 404"
• Passes on the committed tree; workflow YAML parses.

Closes row 5 of P6-E4-W2-S2-T4.