Add crossplug: DSH ↔ mcode bidirectional plugin converter

[Fectivnfy112357]

What it solves

Migrating a plugin between AI coding tools usually means rewriting it for the
target tool's plugin system. crossplug converts plugins in both
directions — DSH (DeepSeek Harness) ↔ mcode (MiniMax Code / pi) — while
keeping the original plugin logic intact (runtime bridging): the source code
runs unmodified inside the converted package, and every mapping decision is
recorded in CONVERSION-REPORT.md.

Try it

Install from /plugins → Local, then:

/convert-plugin dsh2mcode ~/.dsh/.agent-presets/my-agent

Expected result: an agent-plugins.org 1.0.0 package (plugin.json +
skills/) in ./out/ ready for ~/.minimax/plugins/<name>/, plus a
CONVERSION-REPORT.md explaining every mapped row.

Dependencies and platforms

• Node.js 18+; the converter core is zero-dependency CommonJS.
• mcode output targets Agent Plugins 1.0; DSH output targets DeepSeek Harness.

Network and data

• No network access — conversion is fully local (reads local files only).
• No credentials, no telemetry, no external services.

Test evidence

• npm run validate → OK plugin Fectivnfy112357/crossplug
• Package-core regression: core/run.js converts real plugins end-to-end
  (mcode extension → DSH bridge preset/host plugin; tools + command + event
  bridging verified against a live plugin, including system-prompt injection).

[hetaoBackend]

暂不符合收录门禁：

1. CONTRIBUTING 明确禁止 installers，但本 PR 包含 core/install.js，run.js 也暴露 install 命令；它会 rmSync 用户的 /.dsh、/.minimax、~/.pi 目标并写 settings。请从托管 Plugin 中移除安装器，或先提仓库契约变更议题，不能作为普通 Plugin 绕过门禁。
2. README/PR 披露“conversion fully local (reads local files only)”，但实际包还会执行 npm root -g、写/删除用户配置与安装目录。请让披露覆盖所有子命令和副作用，不能只描述 convert 路径。
3. 3674 行运行时代码没有随 PR 提供可运行的自动化测试；“live plugin verified”不可由维护者复现。至少覆盖输入路径边界、输出覆盖、symlink/path traversal、生成 manifest/MCP 的可加载性，以及失败时不破坏既有目录。

当前 npm run validate 只证明 manifest/Skill 目录合规，不能证明转换器或安装行为安全。