fix(plugin): remediate ML-07 R2 findings

tests/unit/coding-capability-registry.test.ts

@@ -86,7 +86,7 @@ function adapter(): CodingPluginAdapter {
 
 function registry(overrides: Partial<ConstructorParameters<typeof CodingCapabilityRegistryImpl>[0]> = {}) {
   return new CodingCapabilityRegistryImpl({
-    policyClient: { getState: () => policy },
+    policyClient: { getState: () => policy, refresh: vi.fn().mockResolvedValue(undefined) },
     getEnabledPluginIds: async () => ['makelore.data-service'],
     adapters: [adapter()],
     definitions: [DATA_SERVICE_PLUGIN_DEFINITION],
@@ -114,13 +114,51 @@ describe('CodingCapabilityRegistry', () => {
     expect(child.pluginIds).toEqual([]);
     expect(child.tools).toEqual([]);
     const unavailable = await registry({
-      policyClient: { getState: () => ({ ...policy, catalog: null, status: 'unavailable', revision: 0 }) },
+      policyClient: {
+        getState: () => ({ ...policy, catalog: null, status: 'unavailable', revision: 0 }),
+        refresh: vi.fn().mockResolvedValue(undefined),
+      },
     }).resolveWorkerResources({
       projectPath: context.projectPath, assignedSkillIds: context.skillIds, role: 'parent',
     });
     expect(unavailable.tools).toEqual([]);
   });
 
+  it('does not wait for policy refresh when child or parent core-only resources cannot consume plugins', async () => {
+    const refresh = vi.fn(() => new Promise<void>(() => {}));
+    const policyClient = { getState: () => policy, refresh };
+    const child = await registry({ policyClient }).resolveWorkerResources({
+      projectPath: context.projectPath,
+      assignedSkillIds: context.skillIds,
+      role: 'child',
+    });
+    const coreOnly = await registry({ policyClient }).resolveWorkerResources({
+      projectPath: context.projectPath,
+      assignedSkillIds: ['grilling'],
+      role: 'parent',
+    });
+
+    expect(child.tools).toEqual([]);
+    expect(coreOnly.effectiveSkillIds).toEqual(['grilling']);
+    expect(refresh).not.toHaveBeenCalled();
+  });
+
+  it('refreshes policy before resolving an assigned server-backed parent plugin', async () => {
+    const refresh = vi.fn().mockResolvedValue(undefined);
+    const getEnabledPluginIds = vi.fn().mockResolvedValue(['makelore.data-service']);
+    await registry({
+      policyClient: { getState: () => policy, refresh },
+      getEnabledPluginIds,
+    }).resolveWorkerResources({
+      projectPath: context.projectPath,
+      assignedSkillIds: context.skillIds,
+      role: 'parent',
+    });
+
+    expect(refresh).toHaveBeenCalledOnce();
+    expect(refresh.mock.invocationCallOrder[0]).toBeLessThan(getEnabledPluginIds.mock.invocationCallOrder[0]);
+  });
+
   it('revalidates invocation, derives the stable Pi request id, and preserves domain faults', async () => {
     const result = await registry().invoke({
       toolName: 'data_service_get_document',