discoverInstalledPlugins read scope from installed_plugins.json but
never filtered by it, so project/local scoped Claude Code plugins
leaked into every session regardless of process.cwd().
Add projectPath to PluginInstallation and InstalledPluginEntryV3,
propagate it through v3EntryToInstallation, and introduce
shouldLoadPluginForCwd which reuses shared/contains-path for safe
symlink- and ancestor-aware matching and expands a leading tilde.
user and managed scopes still always load; project and local without
a projectPath are skipped as a safe default.
Covered by 13 new shouldLoadPluginForCwd unit tests (including tilde
expansion against a mocked homedir) and 13 new discoverInstalledPlugins
integration tests spanning v1, v2, and v3 database formats plus the
existing enabledPluginsOverride path.
Fixes#3216
YeonGyu-Kim
b28567251d