Fix plugin operation lock API

[lawrencecchen]

Use fs4's supported lock_exclusive API so the operation lock compiles and remains exclusive.

Follow-up to #10992.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Fixes the plugin operation lock so it uses fs4's lock API supported by the MSRV and remains exclusive. Also makes plugin installs crash-safe: they now run as journaled transactions with rollback and recovery, and error responses no longer leak internal details.

Details

• install, use, update, and remove acquire the lock; list and read-only paths skip it and reject reads when a recovery journal is pending.
• Replacing a plugin now writes a journal, backs up the existing plugin and registry metadata, and restores them on failure or after interruption.
• Invalid or malformed journals are quarantined, and recovery only touches paths inside the install root.

^{Written for commit e495836. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
cmux166	Ready	Preview	Aug 28, 2026 5:48pm
cmux41	Ready	Preview	Aug 28, 2026 5:48pm

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 6f9ac312-e8d1-4343-86c0-59aee7201320

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[teamleaderleo]

The plugin-manager path this fix targeted was replaced by #13299, which is on main, so this PR is superseded. Closing it.