feat: persist state under plugin-state/ (runner de-privilege)

The managed runner is de-privileged on Windows now (runs as LocalService),
and %ProgramData%\punktfunk is locked read-only to it — so writing config/
cache straight under the config dir fails EPERM (proven on-glass). Move the
plugin's state to <config_dir>/plugin-state/rom-manager, which
`punktfunk-host plugins enable` grants the runner write on. On Linux the
runner owns the config dir, so the path is writable there too — one path, no
branch.

Migrate a pre-0.2.1 config/cache from the old <config_dir>/rom-manager on
first load (copy, guarded, best-effort) so an existing operator's roots +
launch templates survive the move instead of silently resetting to defaults.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/paths.ts

@@ -19,8 +19,21 @@ export const hostConfigDir = (): string => {
 	return path.join(base, "punktfunk");
 };
 
-/** This plugin's private directory: `<config_dir>/rom-manager`. */
+/**
+ * This plugin's private directory: `<config_dir>/plugin-state/rom-manager`.
+ *
+ * The state lives under `plugin-state/`, not straight under the config dir, because the managed
+ * runner is de-privileged on Windows (`NT AUTHORITY\LocalService`) and the config dir is locked
+ * read-only there — `punktfunk-host plugins enable` grants the runner write on exactly
+ * `plugin-state`. (Mirrors `@punktfunk/host`'s `pluginStateDir`; reimplemented locally like
+ * `hostConfigDir`, since we don't want to gate on an SDK version bump.) On Linux the runner owns
+ * the config dir, so the same path is writable with no special step.
+ */
 export const pluginDir = (): string =>
+	path.join(hostConfigDir(), "plugin-state", "rom-manager");
+
+/** The pre-0.2.1 location (`<config_dir>/rom-manager`), migrated away from on first run (state.ts). */
+export const legacyPluginDir = (): string =>
 	path.join(hostConfigDir(), "rom-manager");
 
 /** `<config_dir>/rom-manager/config.json` — operator-editable, atomic-written. */