feat(web): add read-only Loader plugin inventory

packages/bundle/web-app/cordis.patch.yml

@@ -80,6 +80,10 @@
     - id: directory-picker
       name: '@deepseek-ai/dsh-host-directory-picker-auto'
 
+    # Read-only projection of current Loader entries for trusted client RPCs.
+    - id: plugin-inventory
+      name: '@deepseek-ai/dsh-host-plugin-inventory'
+
     # The API gateway: the transport-agnostic dispatch face every client shape
     # shares. The base layer's agent-default-model service owns the default model.
     - id: api-gateway
@@ -172,6 +176,9 @@
     - id: ui-models
       name: '@deepseek-ai/dsh-client-ui-models'
 
+    - id: ui-plugins
+      name: '@deepseek-ai/dsh-client-ui-plugins'
+
     - id: ui-conversation
       name: '@deepseek-ai/dsh-client-ui-conversation'