docs: document plugin contract

[voltjia]

Summary

Document the v1 build-time plugin contract and harden manifest validation before treating plugins as a maintenance boundary.

This PR is stacked on #633 (feat/build-plugin-contract).

Changes

• Add docs/plugin_contract.md with the v1 plugin manifest, CMake API, selection options, and testing expectations.
• Reject unsafe manifest paths such as absolute paths and .. escapes.
• Require device plugins to provide device_headers and test_devices entries for each declared device.
• Add schema/registry tests for the stricter contract.

Validation

• .venv/bin/python -m pytest -s -q tests/test_plugin_registry.py tests/test_plugin_test_matrix.py tests/test_generate_wrappers_plugins.py
• .venv/bin/ruff check scripts/infini_ops_plugin_registry.py scripts/infini_ops_plugin_test_matrix.py scripts/generate_wrappers.py tests/test_plugin_registry.py tests/test_plugin_test_matrix.py tests/test_generate_wrappers_plugins.py
• .venv/bin/python -m py_compile scripts/infini_ops_plugin_registry.py scripts/infini_ops_plugin_test_matrix.py scripts/generate_wrappers.py
• git diff --check
• CPU plugin CMake configure/build smoke

Full-platform validation

Full stack validation was run on the top branch build/external-plugin-source-paths at pre-style-rebase commit 907eff70; see #643 validation comment: #643 (comment). The later rebase only updates PR metadata and diagnostic wording for CONTRIBUTING.md compliance.

• NVIDIA: build passed; pytest failed with 1 failed, 3687 passed, 4404 skipped due to CUDA OOM in tests/test_torch_ops.py::test_op[..., svd] on the PyTorch reference path.
• MetaX: 3183 passed, 3400 skipped.
• Iluvatar: 2689 passed, 3894 skipped.
• Moore: passed after preloading the container OpenMP runtime, 2949 passed, 3643 skipped.
• Cambricon: 1781 passed, 4694 skipped.
• Ascend: pytest passed with 3359 passed, 3233 skipped, but the container exited with code 137; treat as not fully green by the quality gate.