feat(policy): adopt plugin standard 2 contract

[ss-o]

Closes #557 after the release and acceptance dependencies below are resolved.

Summary

• propose ADR 0020 for clean adoption of Zsh Plugin Standard 2
• replace the old plugin policy rules with one-identifier, coherent configuration, no-shared-registry, documented load-surface, and exact-lifecycle contracts
• align review guidance, scaffolding, README guidance, repository bootstrap, testing policy, and ZUnit examples
• replace the scaffold's persistent fpath bookkeeping globals with a zero-state portable entrypoint
• require exact released zsh-lint and ZUnit commit pins, without substituting unreleased PR commits

Instruction impact review

1. Classification: shared organization policy, scoped plugin guidance, and deterministic enforcement.
2. Consumers: Codex, Claude Code, Copilot, Gemini CLI, humans, CI, maintained plugins, and new plugin repositories.
3. Canonical owners: the wiki remains the sole owner of the portable plugin contract; .github owns organization adoption and validation; the official Zsh manual owns language semantics.
4. Duplication: no second technical plugin standard is introduced. Consumers link to the wiki and the machine-readable scripting policy.
5. Routing: the public manifest adds ADR 0020. Existing plugin-standard routes remain correct. The private route already points to the canonical wiki page and public policy repository, so no new private route is added.
6. Runtime delivery: mandatory rules remain in AGENTS.md and routed public instruction surfaces. No hook, agent, or skill is the sole owner.
7. Generated output: public size and policy validators pass. Private composite regeneration remains a post-merge gitlink reconciliation dependency and is not represented as completed on this feature branch.

The coordinated wiki review automation remains in z-shell/wiki#893; this repository does not add a duplicate schedule.

Verification

• python3 scripts/validate-zsh-standard-policy.py
• python3 scripts/validate-agent-policy.py
• 99 Zsh policy tests passed
• 84 agent-policy tests passed
• rendered scaffold lifecycle passed under default options, no_function_argzero, posix_argzero, ksh_arrays, no_unset, and hostile globbing options
• zsh -f -n passed for the scaffold template
• trunk check --filter=-gitleaks passed with no new issues
• direct gitleaks scan passed

Dependencies before ready for review

• docs(standard): define clean portable contract v2 wiki#893 must land the canonical Standard 2 contract and review automation
• feat(project): enforce plugin standard 2 zsh-lint#188 must merge and publish an authorized release
• feat(contract): add portable plugin lifecycle assertions zunit#19 must merge and publish an authorized release
• CI templates must then pin the exact released commits
• ADR 0020 needs a separate maintainer acceptance decision
• the private workspace composite and gitlink must be regenerated and validated after the public policy commit lands