More Stable Local Installation of Plugins with Lock

### Describe the feature or problem you'd like to solve

Currently the the local and web Installation of Plugins is unstable

### Proposed solution

- Improved support when managing root directories for plugin destinations.
- Generally, possessing a lock file facilitates easier switching between locally and globally installed files.
- This could also prove beneficial when using `codex`, `claude`, `gemini` destinations.
- I believe that the long default JSON file for Claude under `~/.claude/` provides more transparent tracking of this information.

**Idea Locking File**
https://github.com/Anselmoo/copilot-plugin-manager/blob/main/cpm.lock
Details

```toml
version = 1
generated = "2026-04-07T19:51:40.433214Z"

[[mcp]]
name = "serena"
rev = "946fdd558f7153c88cd648dd611f95ebb63951e5"
resolved = "2026-04-07T19:51:40.433214Z"
hash = "sha256:86c1ae3fa6ebad47abb0991c958dd7a4bce12840280dfab013638909bc4656a2"
scope = "local"
groups = ["default"]
transport = "uvx"
package = "git+https://github.com/oraios/serena"
entrypoint = "serena"
args = ["start-mcp-server"]
tools = ["*"]
```

**Idea Input File**
https://github.com/Anselmoo/copilot-plugin-manager/blob/main/cpm.toml
Details

[package]
name = "copilot-plugin-manager"
version = "0.1.0"

[settings]
default_scope = "local"

[plugins]

[skills]

[agents]

[mcps]
serena = { rev = "946fdd558f7153c88cd648dd611f95ebb63951e5", type = "stdio", runner = "uvx", package = "git+https://github.com/oraios/serena", entrypoint = "serena", args = [
"start-mcp-server",
], tools = [
"*",
] }

[hooks]

[workflows]

[instructions]

### Example prompts or workflows

```
Commands:
init Initialise a new cpm project in the current directory
add Add an asset to cpm.toml and resolve it
sync Install everything recorded in cpm.lock
remove Remove an asset
promote Promote an asset from local → global scope
demote Demote an asset from global → local scope
update Update one or all assets to their latest versions
run Fetch and run an asset without installing it
overview Show a consolidated view of managed and installed assets
list List installed assets
show Show full details of a single asset
tree Show the dependency tree
doctor Verify all installed file hashes match the lockfile
status Show drift between manifest, lockfile, and disk
lock Resolve without installing (CI use)
reset Reset installed assets and/or manifest state
cache Manage the cpm cache
auth Manage authentication tokens
scope Get or set the default scope
help Print this message or the help of the given subcommand(s)

Options:
-v, --verbose Print additional strategy details for delegated vs native operations
-h, --help Print help
-V, --version Print version

Getting started:
init Create a new cpm.toml + cpm.lock in the current directory
add Add an asset to the manifest and resolve it
sync Install everything recorded in cpm.lock

Manage assets:
remove Remove a managed asset
promote Move an asset from local to global scope
demote Move an asset from global to local scope
update Update one or all assets
run Fetch and run an asset without installing it

Inspect & diagnose:
overview See the combined manifest, lockfile, and disk view
list List installed assets
show Show details for one asset
tree Show the dependency tree
doctor Verify installed file hashes
status Show manifest/lockfile/disk drift

Maintenance:
lock Resolve without installing
reset Remove managed state and installed assets
cache Inspect or clean the download cache
auth Manage authentication tokens
scope Get or set the default install scope
```

and also extend this for agent, skill, and hook installations based on the classical `copilot --help` interface

### Additional context

- That's my current approach: https://github.com/Anselmoo/copilot-plugin-manager for lock files and updating inspired by `uv`

- `bash -c "copilot plugin install`
- https://docs.github.com/en/copilot/how-tos/copilot-cli/customize-copilot/plugins-finding-installing#install-from-a-local-path

Das Issue nennt keine Repository-Dateien oder Tests; beginne mit dem Ablauf für lokale Pfade hinter `copilot plugin install` und vergleiche ihn mit der klassischen Befehlsoberfläche von `copilot --help`. Definiere das Verhalten von Manifest, Lock und lokalem/globalem Geltungsbereich für Plugins, Agents, Skills und Hooks und verifiziere anschließend, dass die aufgeführten Workflows eine stabile Installation und die Erkennung von Abweichungen abdecken.

Vom Indexierungsmodell aus dem Issue-Text verfasst.