refactor(plugins): migrate external plugin manager to grpc/connect

Replace manual HTTP/JSON RPC implementation with generated gRPC/Connect client, providing type-safe plugin communication.

Code Generation:
- Generate plugin.pb.go and pluginv1connect/plugin.connect.go from plugin.proto
- Add generate-plugin-proto Makefile target
- Delete hand-written types.go (replaced by generated code)

ExternalPluginManager Refactoring:
- Replace httpClient with pluginv1connect.PluginServiceClient
- Use h2c (cleartext HTTP/2) transport for gRPC without TLS
- Replace all manual callRPC/callRPCWithContext calls with typed Connect methods
- Remove JSON serialization/deserialization code
- Simplify error handling with native gRPC status codes

Benefits:
- Type safety: compile-time verification of request/response types
- Protocol compatibility: standard gRPC wire format
- Reduced code: ~100 lines of manual RPC code removed
- Better errors: structured gRPC status codes instead of string parsing
- Matches existing Actions runner pattern (Connect RPC over HTTP/2)

This completes the plugin framework migration to production-grade RPC transport.

Makefile

@@ -763,6 +763,12 @@ generate-go: $(TAGS_PREREQ)
 	@echo "Running go generate..."
 	@CC= GOOS= GOARCH= CGO_ENABLED=0 $(GO) generate -tags '$(TAGS)' ./...
 
+.PHONY: generate-plugin-proto
+generate-plugin-proto:
+	protoc --go_out=. --go_opt=paths=source_relative \
+	       --connect-go_out=. --connect-go_opt=paths=source_relative \
+	       modules/plugins/pluginv1/plugin.proto
+
 .PHONY: security-check
 security-check:
 	GOEXPERIMENT= go run $(GOVULNCHECK_PACKAGE) -show color ./...