Plugin signing & trust posture beyond v12 defaults

Capacity-permitting follow-on to the v12 plugin SDK.

## Idea

v12 ships full-trust, in-process plugin loading (RFC #100). This issue tracks the harder follow-on questions:

- Assembly signing requirements for plugins (Authenticode, NuGet package signing).
- AssemblyLoadContext-based isolation for untrusted plugins.
- A trust-posture knob on the host (`AllowUnsigned`, `RequireSignedBy`).
- Threat model: what attacks does signing actually mitigate in a build-time context?

## Why not now

Not committed for v12 — the default trust posture is fine for the actual v12 user (already runs arbitrary build code). Track for later if a use case shows up.

## Cross-ref

- RFC #4 / #100 (defines the v12 baseline).