feat(scripting): discover scoped @punktfunk/plugin-* packages

The runner only found unscoped `punktfunk-plugin-*` packages. An unscoped
package can't be split across registries, which forced plugins to bundle their
own copy of @punktfunk/host + effect (the plugin's Gitea registry has no
`effect`; `--registry <gitea>` 404s it). Discovering the scoped
`@punktfunk/plugin-*` convention lets a plugin resolve cleanly from one scope
map and depend on @punktfunk/host + effect as SHARED (hoisted) deps instead of
bundling — no per-plugin duplication. Additive: unscoped names still work.

Bumps @punktfunk/host to 0.1.1.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

sdk/test/runner.test.ts

@@ -83,6 +83,25 @@ describe("discovery", () => {
 		expect(logs.join("\n")).toContain("REFUSING");
 		expect(logs.join("\n")).toContain("evil.ts");
 	});
+
+	test("discovers scoped @punktfunk/plugin-* packages (not other scoped pkgs)", () => {
+		const d = mkdirs("discover-scoped");
+		write(
+			path.join(d.pluginsDir, "node_modules", "@punktfunk", "plugin-y", "package.json"),
+			JSON.stringify({ name: "@punktfunk/plugin-y", module: "dist/index.js" }),
+		);
+		write(
+			path.join(d.pluginsDir, "node_modules", "@punktfunk", "plugin-y", "dist", "index.js"),
+			"export default { name: 'y', main: async () => {} };",
+		);
+		// A non-plugin scoped package (e.g. the SDK itself) is ignored.
+		write(
+			path.join(d.pluginsDir, "node_modules", "@punktfunk", "host", "package.json"),
+			JSON.stringify({ name: "@punktfunk/host" }),
+		);
+		const units = discoverUnits(d);
+		expect(units.map((u) => u.name)).toEqual(["@punktfunk/plugin-y"]);
+	});
 });
 
 describe("supervision", () => {