feat(plugins): run portable MCP components

docs/configuration.md

@@ -2306,16 +2306,17 @@ Disabled skills are excluded from the main agent's skill summary, from always-on
 |--------|---------|-------------|
 | `agents.defaults.disabledSkills` | `[]` | List of skill directory names to exclude from loading. Applies to both built-in skills and workspace skills. |
 
-### Agent Plugins v1 skills
+### Agent Plugins v1
 
 nanobot also discovers portable [Agent Plugins](https://agent-plugins.org/) placed under
 `<workspace>/plugins/<plugin>/`. A supported package has a root `plugin.json` that targets
-Agent Plugins v1 and one or more direct-child skills:
+Agent Plugins v1 and may provide skills, MCP servers, or both:
 
 ```text
 plugins/
 └── release-tools/
     ├── plugin.json
+    ├── mcp.json
     └── skills/
         └── release-notes/
             └── SKILL.md
@@ -2326,10 +2327,17 @@ skills. A workspace skill wins when it has the same name as a plugin skill; plug
 over built-in skills. Invalid manifests, invalid Agent Skills, nested skill directories, and
 paths that resolve outside the plugin root are ignored.
 
-This initial compatibility layer loads the portable `skills/` component only. Agent Plugins
-`mcp.json` is not started automatically: local MCP servers execute third-party processes and
-need an explicit trust and approval flow. Configure a reviewed MCP server through **Apps** or
-`tools.mcpServers` for now.
+Portable MCP servers declared in `mcp.json` appear in **Apps**, but are never started merely
+because a package exists. Enabling a plugin there is the explicit trust decision that activates
+its executable components. The host expands `PLUGIN_ROOT` and an isolated `PLUGIN_DATA`, checks
+package paths before launch, and hot-reloads MCP connections. Explicit `tools.mcpServers`
+configuration wins over a plugin server if their host names collide. The v1 host currently
+supports plugin `stdio` servers; unsupported remote transports are skipped independently.
+
+Plugins may optionally declare a shell-free `extensions.dev.nanobot.installCommand` array. The
+local WebUI runs it once per plugin version before first enable; remote WebUI clients cannot run
+plugin setup unless remote package installation was explicitly allowed. Agent Plugins v1 does
+not define a registry, so package distribution remains separate from discovery and execution.
 
 CLI Apps installed from the WebUI use the same package layout. nanobot installs the CLI through
 its catalog adapter, then writes a skills-only Agent Plugin under `<workspace>/plugins/`; updates