fix(core): drop early guarded plugin activation

[rekram1-node]

Stopgap for regressions from #53775. This removes the first-generation registry.activate(pre.filter(guarded)) step in PluginSupervisor while we restructure how organization policy is loaded before plugin resolution.

Why

The early step activates OpencodePlugin as a separate plugin generation before the full activation. That has three side effects:

• Startup waits on every MCP server. The early batch triggers MCP's first reconcile, the path that starts servers in the background. Config MCP servers then arrive in a later reconcile, which connects them one at a time inside plugin activation. Models and /connect stay empty until the slowest server is up.
• OpencodePlugin is set up twice. Plugin.activate keeps only an unchanged leading prefix of running plugins. [OpencodePlugin] is never the prefix of the full list, so it is torn down and set up again, and the Console config is fetched twice.
• Console MCP servers can start before policy filters them. guarded includes ConfigPolicyPlugin, but the filter runs over pre and that plugin is in post. The early batch adds Console MCP servers with no integration.use filter. They can start before the full activation removes them.

What still works

OpencodePlugin and ConfigPolicyPlugin are now set up in the same batch. managed.set(...) happens before MCP and provider transforms are evaluated.

• provider.use, tool.use, and integration.use for mcp:*, from config and org, all apply from the first reconcile.
• integration.use for plugin:* from config files still blocks before install or import, because PluginModule reads config entries directly.
• Org policy changes still re-run activation through managed.changes().

Known gap

At startup, an external plugin denied by Console org policy is installed and set up once before it is unloaded. The first resolve() runs before Console statements arrive. managed.changes() then triggers a re-activation that blocks and unloads it. Config-authored plugin denials are unaffected. The follow-up is to load org policy ahead of resolve() without activating a plugin generation.

Verification

• bun test test/plugin/supervisor-reload.test.ts test/plugin/module.test.ts test/plugin/provider-opencode.test.ts test/config/policy.test.ts test/mcp.test.ts: 143 pass
• bun typecheck in packages/core: clean

Supersedes the startup fix in #53813 (its stale-start guard is still worth landing separately).