Refresh built-in plugin hashes when loading trusted-plugins.json (#733)

[Hirogen]

Fixes #733

Summary

trusted-plugins.json stored the built-in hash table from the first run and never updated it. After an upgrade, every built-in plugin failed hash verification, so only the columnizers inside LogExpert.Core were available.

 LoadTrustedPluginConfiguration
   file exists
     deserialize
     if null → defaults + save
+    else if RefreshBuiltInPlugins(config)   # running build's GetBuiltInPluginHashes() is authoritative
+      save

RefreshBuiltInPlugins(config)
  add any missing built-in name to PluginNames
  for each (name, hash) in GetBuiltInPluginHashes()   # incl. "(x86)" keys
    if missing or different → overwrite
  if changed → bump LastUpdated

User-trusted entries and AllowUserTrustedPlugins are not touched. The troubleshooting section of PLUGIN_HASH_MANAGEMENT.md described the old behaviour and has been updated.

Evidence

New tests in PluginValidatorConfigPersistenceTests. Hash verification is forced on and the config folder is a temp folder:

seed trusted-plugins.json: CsvColumnizer.dll = 000…0, UserPlugin.dll = ABCDEF, AllowUserTrustedPlugins = false
Initialize(tempDir)
ValidatePlugin(bin/<Config>/plugins/CsvColumnizer.dll)

• Before: Initialize_WithStaleBuiltInHash_ValidatesBuiltInPlugin failed with "Expected hash: 00000000…". …PersistsRunningBuildHashesAndKeepsUserEntries failed because the stale hash was kept and JsonColumnizer.dll was missing from PluginNames.
  After: both pass. The saved file holds the running build's hashes, and the user entry and the setting are unchanged.
• Guard: ValidatePlugin_TamperedBuiltInPlugin_IsRejectedWithHashMismatch passes before and after. A copy of CsvColumnizer.dll with one byte appended is still rejected with "has been modified".
• Full suite: green (7 tests skipped).

Merge Danger

Door: two-way

On first launch the file is rewritten with the current build's hashes. Rolling back the code just brings back the old behaviour. Nothing is deleted, and user-trusted entries survive.

Blast Radius: plugin loading

Every built-in plugin goes through this path in Release builds. If the generated hash table were wrong, the built-in plugins would be rejected. They already are today after an upgrade, but this change would also affect fresh installs. Debug builds skip hash verification, so CI's Release test run is the first real check.