[maya-ots]

What

Extend plugin hook dispatch to teardown and Kubernetes deployment paths, and add opt-in required plugins that can block operations when their hooks fail.

Closes #42

How

• Added before_down and after_down hooks for mctf down, keeping teardown semantics distinct from deployment hooks.
• Wired plugin hooks into the Kubernetes applyKube path, dispatching deploy hooks for up and teardown hooks for down.
• Added the required plugin configuration option, defaulting to false.
• Updated plugin loading and dispatch behavior so failures from required plugins can veto operations, while non-required plugins remain best-effort.
• Preserved the existing "before" and "after" phase values and added "kubernetes" as a supported deployment mode in the payload documentation.
• Updated the configuration schema copies and docs/spec/plugins.md to document required-plugin behavior and the additional hooks.
• Added tests covering the required-plugin veto path and teardown hook delivery.
• Ensured successful teardown hooks are not dispatched for dry-run operations.

Verification

• go build ./...
• go test ./...
• golangci-lint run ./...
• mctf generate --check on the sample event (if derived files could change)
• Docs updated (docs/spec/plugins.md)
• Schema updated in both schema copies
• make schemas synced and verified
• go test ./internal/plugin ./cmd — passed

Notes

• Required plugins intentionally change failure behavior only when required: true is configured; the default remains best-effort.
• Required-plugin failures can block operations at the relevant pre-operation hook.
• The focused plugin and command tests pass. The full test suite, build, lint, and schema-generation checks have not yet been confirmed.

---