#7204: Plugins: default non-bundled plugins off

## Summary - default non-bundled plugins to **disabled** unless explicitly enabled - prevent automatic execution of non-bundled plugin `register` hooks on gateway restart - update plugin loader/tool tests to require explicit enable - update plugin docs to reflect default disable behavior ## Security Non-bundled plugins were being auto-registered on gateway restart, which effectively auto-executed code discovered on disk. This change requires an explicit enable step, reducing the risk of unintended plugin code execution. ## Testing - pnpm test passed <!-- greptile_comment --> <h2>Greptile Overview</h2> <h3>Greptile Summary</h3> This PR changes plugin enablement defaults so non-bundled (installed / discovered on disk) plugins are **disabled unless explicitly enabled** via `plugins.entries.<id>.enabled` (or CLI enable), and updates tests/docs to reflect the new behavior. The core logic is in `src/plugins/config-state.ts` (default enable state) and is consumed by the plugin loader (`src/plugins/loader.ts`) and config validation (`src/config/validation.ts`), while tests now set `entries.<id>.enabled=true` where plugin execution is expected. <h3>Confidence Score: 4/5</h3> - This PR looks safe to merge and primarily tightens plugin execution defaults, with low functional risk outside of expected behavior changes. - I reviewed the changed logic in `resolveEnableState` and traced its use through plugin loading and config validation; the behavior change is consistent across these call sites and tests were updated accordingly. Main remaining risk is behavioral: existing users relying on auto-enabled non-bundled plugins will now need explicit enablement, and some doc phrasing could still be misinterpreted. - docs/plugin.md (wording clarity around enablement defaults), src/plugins/config-state.ts (ensure intended default-off semantics are correct for all non-bundled origins) <!-- greptile_other_comments_section --> _{(2/5) Greptile learns from your feedback when you react with thumbs up/down!} <!-- /greptile_comment -->