Built-in plugin registration doesn't scale: binary size + startup cost grows unconditionally with every plugin

## Context

game-ci/cli#230 registered `@game-ci/bevy` as a built-in plugin (a literal `import()` in `cli.ts`'s `loadPlugins()`, traced and embedded directly into the compiled binary) because it isn't published to npm and `--plugin @game-ci/` (which resolves via `loadFromNpm`) can't reach it at runtime. A follow-up does the same for five more functional-but-unpublished plugins: `github-release-deploy`, `itch-deploy`, `pseudo-localization`, `code-signing`, `steam-workshop`.

This pattern has a real cost that will keep growing as more plugins are added this way:

1. **Binary size**: every built-in plugin's code is unconditionally bundled into the single compiled `game-ci` binary via Bun's `--compile`, whether or not a given invocation ever touches it. This is unlike the genuinely-opt-in `--plugin ` path (`PluginLoader.load`'s string-parameter/`loadFromNpm` route), which is a dynamic import Bun's bundler can't trace - confirmed earlier this repo's own workspace plugins impose zero bundle cost on unrelated invocations *when loaded that way*. Built-in registration gives up that property.
2. **Startup cost**: `loadPlugins()` calls `PluginLoader.loadModule()` (and therefore each plugin's `onLoad()`, if it defines one) unconditionally on **every** CLI invocation - `game-ci --help`, `game-ci build ./unity-project`, anything - regardless of whether that plugin is relevant. Today's built-ins are presumably cheap (synchronous command-factory registration, no I/O), but nothing enforces that, and the list will only grow.

Six built-ins (soon) is probably still fine. But there's no mechanism today to keep this bounded, and "not published to npm" is currently the *only* trigger for going down the built-in path - which will keep happening as new plugins ship, since none of the newer ones are on npm either yet.

## Ask

Investigate a real fix for the underlying gap instead of continuing to grow the built-in list:

- Publish these plugins to npm (npm) so `--plugin ` actually works for them via the existing `loadFromNpm` path - the original, genuinely-opt-in mechanism this was designed around - OR
- Implement `PluginLoader`'s `github:` loading path (currently a stub that throws "not yet implemented") so a plugin can be fetched/loaded from this repo without needing either npm or unconditional binary embedding, OR
- Some other mechanism that keeps unrelated `game-ci` invocations from paying for plugins they don't use, as the plugin count grows.

Whichever direction, it'd help to also measure the actual current cost (binary size delta, `--help` startup time) with today's 6 built-ins as a baseline, so future additions have a concrete number to weigh against.

Start with cli.ts's loadPlugins() and compare the existing PluginLoader.load/loadFromNpm route with the stubbed github: loading path. Measure binary size and --help startup time with the current six built-ins, then evaluate a mechanism that avoids loading or embedding unrelated plugins. Done means a documented, tested approach that addresses the unpublished-plugin gap and includes the baseline measurements.

Written by the indexing model from the issue text.