Add out-of-band plugin rescue

[Drecullith]

Summary

Adds an out-of-band recovery path for broken third-party shell plugins.

When a third-party Quickshell plugin breaks the normal shell environment, the usual plugin-management path may no longer be usable. This adds omarchy plugin rescue, which operates directly on the user's shell configuration without loading or executing third-party plugin code.

What it does

• snapshots the current shell.json before making changes
• removes or replaces only third-party plugin references
• restores trusted built-in sources for active Omarchy clones when known
• preserves unrelated shell configuration
• never deletes or executes third-party plugin files
• supports exact restoration of the original configuration
• refuses normal restore if the config was modified while rescue mode was active
• serializes rescue/restore operations to prevent concurrent state mutation
• aborts if shell.json changes during rescue instead of overwriting newer changes

Why

Plugin recovery should not depend on the same shell/plugin environment that may already be broken.

This provides a small recovery path that can be run from a terminal or TTY and keeps the scope limited to third-party shell-plugin references rather than resetting the user's entire shell configuration.

Testing

Adds isolated shell tests covering:

• third-party bar/widget/service removal
• stale plugin references
• trusted clone restoration
• hostile clone metadata
• malformed manifests
• exact restore
• restore conflict protection
• safe configuration installation before shell restart

Plugin files are never executed during recovery.