refactor(plugins): stamp the PluginKit version from one build setting

[datlechin]

Why

The PluginKit version was a Swift literal in PluginManager.swift, copied by hand into every plugin plist, and four scripts grepped it out of Swift. Step 12 of the release rewrite.

Change

• Configs/PluginKit.xcconfig holds the current and minimum kit; Base.xcconfig includes it.
• Plugin plists are preprocessed, so TableProPluginKitVersion stays an <integer>. The app's Info.plist carries both values for PluginManager, which fails a precondition when one is missing.
• The DriverPlugin template signs with the team and the hardened runtime and strips in Release; Base.xcconfig's signing comment says so. Plugin test bundles stop borrowing a plugin's plist.
• build-plugin.yml, build.yml, release-plugin-for-shipped-app.sh and the bump-cadence check read the xcconfig; older tags fall back to Swift.

Verified

BundledPluginStampTests fails when a plugin plist stamps the kit as a string. Every plugin builds with an integer kit and loads, in Debug and in a Release probe.

Not in this PR

• Docs PR ci: read the PluginKit version from Configs/PluginKit.xcconfig docs#31 merges right after this, before the 06:17 UTC docs run.
• BundledPluginStampTests checks the kit only: plugin CFBundleVersion equals the app's after step 23 drops the template's CURRENT_PROJECT_VERSION: 1.
• Source plugin plists fail plutil -lint by design; no CI step lints them.
• Stamping TableProProvides* from each plugin's Swift ids, with a plist == Swift check, is a follow-up.
• Step 26 rewrites check-pluginkit-abi.sh, whose advice still names currentPluginKitVersion, and drops the cadence step in repo-hygiene.yml.
• CONTRIBUTING.md:42 still says plugins sign ad hoc; RELEASING.md is rewritten later.