feat(plugin-kit): @punktfunk/plugin-kit 0.1.0 — the Effect plugin framework

The ~80% of every plugin that was copy-pasted (rom-manager ↔ playnite),
extracted as one Effect-v4 package:

- runtime: definePluginKit — async-main boundary hiding a ManagedRuntime
  (two-effect-instances discipline), signal-driven interruption with a
  bounded shutdown grace
- config: Schema-driven raw round-trip (defaults only in the Schema via
  withDecodingDefaultKey + encodingStrategy omit; file stays authored-shape),
  atomic writes, world-writable refusal, changes stream
- cache-store: disposable derived state, corrupt→empty, write-through
- reconcile: kit-owned provider wire schemas + typed client over the
  skew-safe untyped pf.request seam
- sync-engine: generic poll/watch/debounce/single-flight-coalesce/
  fingerprint-skip engine with a status PubSub (the SSE feed)
- ui-server + sse: effect/unstable/httpapi behind servePluginUi with
  core-only env layers (validated by the phase-0 spikes); raw SSE route
  (httpapi has no event-stream media type)
- cli: minimal command dispatcher reusing the plugin layer graph
  (deliberately not effect/unstable/cli — it needs platform packages)
- react subpath: plugin router (path→hash→fallback deep-link restore +
  pf-ui:navigate bridge), ResultGate, sseAtom, resolvePluginBase
- theme.css: the console's violet identity packaged for plugin UIs

18 bun tests incl. the two phase-0 spikes; publish workflow mirrors
sdk-publish (tag plugin-kit-v*; 0.1.0 published manually).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

plugin-kit/src/errors.ts

@@ -0,0 +1,49 @@
+// Kit-level error taxonomy. `Data.TaggedError` (matching the SDK's idiom in
+// sdk/src/client.ts) — these never cross HTTP; a plugin's UI-API contract defines its own
+// Schema-based errors with status annotations.
+import { Data } from "effect";
+
+/** A management-API call through the pf facade failed. */
+export class HostRequestError extends Data.TaggedError("HostRequestError")<{
+	readonly method: string;
+	readonly path: string;
+	readonly cause: unknown;
+}> {}
+
+/** config.json exists but does not parse/decode. */
+export class ConfigParseError extends Data.TaggedError("ConfigParseError")<{
+	readonly path: string;
+	readonly issue: string;
+}> {}
+
+/**
+ * config.json is group/world-writable (POSIX). This file controls commands run as the
+ * host user, so the kit refuses it — the same sshd rule the runner applies to unit files.
+ */
+export class ConfigPermissionError extends Data.TaggedError(
+	"ConfigPermissionError",
+)<{
+	readonly path: string;
+	readonly mode: number;
+}> {
+	override get message(): string {
+		return `refusing ${this.path}: it is group/world-writable (chmod go-w it first) — this file controls commands run as the host user`;
+	}
+}
+
+/** Persisting config/state failed. */
+export class ConfigWriteError extends Data.TaggedError("ConfigWriteError")<{
+	readonly path: string;
+	readonly cause: unknown;
+}> {}
+
+/** The plugin UI server could not be started/registered. */
+export class UiServeError extends Data.TaggedError("UiServeError")<{
+	readonly cause: unknown;
+}> {}
+
+/** A sync pass failed (compute or apply). */
+export class SyncError extends Data.TaggedError("SyncError")<{
+	readonly reason: string;
+	readonly cause: unknown;
+}> {}