feat(plugins): add runtime handshake boundary

plugins/xgrids-k1/README.md

@@ -50,10 +50,12 @@ other vendor state. The frontend contribution imports the host only through
 `@mission-core/plugin-sdk`; its CSS is scoped below `.xgrids-k1-plugin`.
 
 Backend startup loads the reviewed factory declared by `backendEntrypoint`, then
-cross-checks its plugin ID and complete action set against this manifest.
+cross-checks the runtime-owned plugin ID, version, supported host API and exact
+action set against this manifest. The runtime must complete the versioned
+control-plane handshake and report `ready` before any action is admitted.
 Actions enter through the host dispatcher and the transitional facade
 `src/k1link/device_plugins/xgrids_k1/facade.py`. The old flat routes live in the plugin's
-legacy router; both paths delegate to the same proven
+legacy router; both paths now cross the same runtime transport and delegate to the proven
 `XgridsK1CompatibilityService` methods. Synchronous capture/runtime operations
 run outside the FastAPI event loop.
 
@@ -62,8 +64,9 @@ semantic `acquisition.stop` in `capture-only` mode; replay and pre-v1alpha2
 sessions retain the legacy `stream.stop` shim. Neither path claims that the
 physical K1 stopped without separate operator evidence. BLE, MQTT, codec,
 archive discovery and RRD export modules now live under the plugin package
-after replay parity and physical K1 regression. Process isolation and signed
-deployment remain later supervisor gates.
+after replay parity and physical K1 regression. The current transport remains
+in-process and its health is lifecycle-only; process isolation, crash/restart
+containment and signed deployment remain later supervisor gates.
 
 The compatibility profile is descriptive and cannot itself authorize a vendor
 write. The current runtime cannot inspect K1 firmware: it keeps the profile