feat(plugin): run plugin-provided installers through the RPC worker

A plugin can now hand an InstallerInterface implementation to
InstallationManager::addInstaller across the wire, and a legacy
composer-installer package is loaded as one; both are backed by a
PhpInstallerProxy forwarding the whole installer contract to the entity in
the PHP worker. An installer returning a real promise is an explicit error
until promises can cross the boundary.

InstallationManager takes installers as shared handles instead of boxes, so
the object identity removeInstaller and PluginManager's registeredPlugins
compare against survives registration, and holds them in a RefCell:
Installer::run keeps a shared borrow of the manager for the whole run, and a
plugin activated inside it registers its installer from there. The type
cache keys on the installer itself, like upstream, so re-entrant
registration cannot leave a stale index behind. InstallerInterface::supports
is fallible for the same reason getCapabilities and getCommands are: it
answers over RPC.

Cloning a proxy stub clones the Rust-side entity and rebinds the copy to the
fresh handle. Previously only the classes declaring __clone got a throwing
body, and the rest let two stubs share (and twice release) one handle.
Package entities answer with AnyPackage::dup, which already carries
BasePackage::__clone and the RootAliasPackage override; the others are an
explicit error.

The package proxy covers the whole PackageInterface surface; only the link
maps and the release date still lack a wire image for their value objects.
PluginManager gains a test-only seam for the reported Plugin API version,
and the three PluginInstallerTest cases that need it are ported.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

1 files changed, 7 insertions, 3 deletions

diff --git a/docs/dev/plugin-stub-generation.md b/docs/dev/plugin-stub-generation.md
index e10c0e9c..33025df7 100644
--- a/docs/dev/plugin-stub-generation.md
+++ b/docs/dev/plugin-stub-generation.md
@@ -72,9 +72,13 @@ the generator's vendor directory or the classifier report is unavailable.
 * **Public instance properties** are not declared on the stub; `__get`/`__set`
   forwarders carry every access (including dynamic-property writes) to the
   Rust side, where an unsupported name is an explicit error.
-* **`__toString`** is forwarded like any other method. **`__clone`** emits a
-  throwing body: proxy clone semantics are an open design question, and
-  cloning must not silently share the Rust handle between two stubs.
+* **`__toString`** is forwarded like any other method. **`__clone`** is part of
+  the boilerplate on every stub, whether or not the real class declares one:
+  PHP has already copied the stub by the time it runs, so the copy asks the
+  Rust side for a clone of the entity and rebinds itself to the fresh handle
+  (`__shirabeClone`, answered with `[rhandle, epoch]`). The clone semantics of
+  the real class live on the Rust side with the entity; entities that model no
+  clone answer with an explicit error.
 * **Imports**: the original file's `use` statements are kept in their original
   order, restricted to names the emitted stub references; signatures declared
   elsewhere (interface files) are re-spelled through that import table.