Add plugin: `preflight-network` (TCP connectivity check)

Preflight plugins abort an agent run before the spawn happens. `preflight-warp` and `preflight-cmd` already ship. A common reason for an agent to fail is "no network" — a laptop just woke from sleep, the VPN dropped, the office wifi flaked. Right now the agent has to run, fail, retry, and probably notify before anyone realizes the actual problem is network.

## Proposal

A new plugin `preflight-network` that checks connectivity to one or more endpoints before the agent runs. If any check fails, preflight aborts with a helpful `suggest` field.

Manifest usage:

```toml
[[preflight]]
plugin = "preflight-network"
hosts = ["api.github.com:443", "honeycomb.io:443"]
timeout_seconds = 5
```

The plugin reads the host list from its config, opens a TCP connection to each, and exits 0 if all succeed.

## Acceptance criteria

- [ ] New plugin crate under `plugins/preflight-network/` following the convention of `preflight-cmd`.
- [ ] Speaks the standard plugin protocol (`info` / `validate` / `invoke`).
- [ ] Each host is checked in parallel; total time bounded by `timeout_seconds`.
- [ ] On failure, the `suggest` field names the host(s) that timed out.
- [ ] Doc page under `docs/plugins/preflight-network.md`.
- [ ] Registered in the workspace `Cargo.toml`.

## Where to start

- `plugins/preflight-cmd/` — closest analogue.
- [`docs/reference/plugin-protocol.md`](docs/reference/plugin-protocol.md) — protocol spec.
- [`.claude/skills/new-plugin/SKILL.md`](.claude/skills/new-plugin/SKILL.md) — scaffolding skill if available.

## Non-goals

- DNS lookups vs TCP connects: do TCP. Anyone wanting "is DNS up" can put `8.8.8.8:53` in the list.
- HTTP semantics (status codes etc). TCP connect is enough signal.

Start with plugins/preflight-cmd/ and read docs/reference/plugin-protocol.md, then check .claude/skills/new-plugin/SKILL.md for the project’s scaffolding convention. Register the new crate in the workspace Cargo.toml and add docs/plugins/preflight-network.md. Done means the plugin implements info, validate, and invoke, checks configured TCP hosts in parallel within the timeout, and reports failed hosts in suggest.

Written by the indexing model from the issue text.