feat: introduce device plugin runtime boundary

docs/adr/0002-mission-core-monorepo.md

@@ -42,7 +42,8 @@ The rename does not alter these proven interfaces:
 - native `.k1mqtt` framing and `K1MQTT` magic;
 - provisioning profile `xgrids-k1-fw3-wifi-v1`;
 - K1 MQTT topics and firmware-scoped protobuf/LZ4 codecs;
-- current `k1_ip`, `K1Metrics`, and `useK1Console` compatibility fields;
+- wire-level `k1_ip` and metric values (their frontend type/hook names may move
+  behind the plugin boundary; see ADR 0003);
 - schema v1 `$id`, which remains an immutable legacy identifier.
 
 Those names move or change only during the plugin-extraction milestone with
@@ -55,5 +56,8 @@ explicit migration and regression tests.
 - The existing K1 implementation remains operational while contracts are
   extracted incrementally.
 - Core must eventually boot without the XGRIDS plugin.
-- Plugin failure must not terminate the Mission Core host or raw evidence plane.
+- An invalid installed manifest, missing factory, or manifest/runtime drift fails
+  startup before the host accepts traffic. After successful startup, an action
+  failure is isolated to that namespaced plugin request and must not terminate
+  the Mission Core host or raw evidence plane.
 - A future repository split remains possible after Plugin SDK v1 is stable.