loader: Plugin<K> is !Clone; shared holders hold Arc<Plugin<K>>

[MattJackson]

CONTRACT-ABI lane: Plugin<K> is !Clone.

THE DESIGN C.1 (docs/design/BUSBAR-1.6.0.md l.3864-3868, "Compiled-in uses the same table, Types"): Plugin<K> is !Clone. On predev crates/plugin-loader/src/dispatch/plugin.rs:1278 implemented Clone, documented as "cheap to clone; every clone is the same instance". That impl is deleted. A holder that shares an instance now shares an Arc<Plugin<K>>.

Call sites (every one that cloned a handle):

• dispatch/plane_calls.rs PlaneInstance and dispatch/auth_outbound.rs OutboundInstance hold Arc<Plugin<K>>. Their constructors take impl Into<Arc<Plugin<K>>>, so a caller that hands its plugin over owned is unchanged. They stay Clone because they clone the Arc; OpenOnce hands them out.
• busbar root boot.rs: DoorPlane is Arc<Plugin<Plane>>, wrapped once at load_door_planes. serve.rs compose_planes_over shares the boot's instance into the generation's PlaneInstance and its DoorApply, at the two plugin.clone() sites l.1427 and l.1571.
• auth_door.rs: the instance's tick schedule (auth_ticks::spawn, which now takes Arc<Plugin<Auth>>) and its Shared hold one Arc. Before, plugin.clone() was at l.648.
• hook_door.rs: State::Live holds Arc<Plugin<Hook>>, so live()/trial() hand out the shared instance (before, p.clone() at l.230 and l.292), and Submitted holds it.
• conformance/mod.rs red_ready and conformance/store.rs fold hand their store plugin to LoadedStore::open by value and keep reading its crossing gate through the instance (crossings_of(&p.inner)), with no copy of the handle.
• Tests: plane_driver.rs, hook_parity_driver/rig.rs, dispatch_tests.rs (the two hung-call REDs), and the root serve_*/door_steps rigs that build a DoorPlane.

Generic dispatcher calls on a now-shared handle pass &*plugin.

RED: plugin-loader tests::dispatch_tests::a_plugin_handle_is_not_clone. It is an ambiguity probe (the assert_not_impl_any construction) that does not compile while Plugin<K>: Clone, so it is red on predev and green here.

Shared files (rule 20): git merge-tree is clean against predev and against every non-draft open PR that edits these files: #946, #943, #922, #921, #913, #910, #887, #876, #848, #841, #833, #805, and the lane's own #952/#968. None of those PRs adds a Plugin clone, a DoorPlane or a PlaneInstance site that this change would break.

No dependency change. No behaviour change: every clone was the same instance before, and the Arc is that same instance.

[MattJackson]

Rule 20 note from #1030 (row 155): disjoint hunk in crates/busbar/tests/plane_driver.rs (zero_piece_out adds tap_fault: 0, _fault_reserved: [0; 2]). A test merge is clean.

[MattJackson]

Rule 20 note from #1031 (row 155, draft): one test appended to crates/busbar/src/root/tests/door_steps.rs. A test merge is clean.