refactor(cli): share file-backed plugin activation

[bbednarski9]

Overview

This is the second, stacked change for #673. It migrates the NeMo Relay CLI runtime owner onto the file-backed activation foundation introduced by #684. Please review and land #684 first; this PR intentionally targets feat/python-plugin-file-activation while both changes remain drafts.

• I confirm this contribution is my own work, or I have the right to submit it under this project's license.
• I searched existing issues and open pull requests, and this does not duplicate existing work.

Details

• Replaces the CLI's private static, native, and worker activation owners with PluginFileActivation and PluginHostActivationPlan.
• Carries the resolver's had_input state and redacted inherited-source diagnostics through normal server and transparent-run startup. A physical or explicit empty configuration now owns the same process-wide activation lease as static or dynamic configuration; true no-input startup remains inactive.
• Builds every dynamic plan entry from the exact immutable DynamicPluginActivationSnapshot Arc already used for managed-bootstrap identity. Activation uses only the snapshot manifest and managed-environment references, with no fallback to mutable original paths.
• Leaves CLI discovery, lifecycle reconciliation, trust and environment validation, bootstrap readiness, and installation/editing commands in their existing adapter roles.
• Preserves all-or-nothing activation and shutdown ordering: sessions close first, subscribers flush second, then the owned host removes callbacks, plugin kinds, workers, libraries, snapshots, and its process lease.
• Includes the activation-ownership bit in the persistent gateway fingerprint so an absent configuration cannot reuse a daemon started for an existing empty plugins.toml, or vice versa.

Validation completed:

• cargo test -p nemo-relay-cli — 1,204 library tests, 12 architecture tests, and 98 CLI integration tests passed.
• just test-rust — full Rust, native plugin, worker plugin, Python native-binding, CLI, FFI, and doctest matrix passed.
• cargo clippy --workspace --all-targets -- -D warnings passed.
• cargo fmt --all -- --check and git diff --check passed.
• uv run pre-commit run --all-files passed.
• cargo package --locked --package nemo-relay-cli --allow-dirty --list confirmed the migrated sources and tests remain in the CLI package; package metadata is unchanged in this stacked PR.

There are no public CLI flags or configuration-format changes in this PR.

Where should the reviewer start?

Start with crates/cli/src/server/mod.rs, especially initialize_plugin_host() and plugin_host_activation_plan(). Then review the plugin_had_input and diagnostics plumbing in crates/cli/src/configuration/mod.rs, crates/cli/src/commands/mod.rs, and crates/cli/src/process/launcher.rs. The exact snapshot-identity, owned-lifecycle, rollback, and shutdown assertions are in crates/cli/tests/coverage/shared/server_tests.rs and config_tests.rs.

Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to)

• Relates to [Enhancement]: Initialize discovered [[plugins.dynamic]] without caller-built specs in Python #673
• Stacked on feat(python): initialize plugins from TOML #684

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: a24c10de-3dfc-49cf-b8dc-4a99f83fa249

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Fern docs preview: https://nvidia-preview-pull-request-685.docs.buildwithfern.com/nemo/relay/dev