More Stable Local Installation of Plugins with Lock

### Describe the feature or problem you'd like to solve

Currently the the local and web Installation of Plugins is unstable

### Proposed solution

- Improved support when managing root directories for plugin destinations.
- Generally, possessing a lock file facilitates easier switching between locally and globally installed files.
- This could also prove beneficial when using `codex`, `claude`, `gemini` destinations.
- I believe that the long default JSON file for Claude under `~/.claude/` provides more transparent tracking of this information.

**Idea Locking File**
https://github.com/Anselmoo/copilot-plugin-manager/blob/main/cpm.lock
Details

```toml
version = 1
generated = "2026-04-07T19:51:40.433214Z"

[[mcp]]
name = "serena"
rev = "946fdd558f7153c88cd648dd611f95ebb63951e5"
resolved = "2026-04-07T19:51:40.433214Z"
hash = "sha256:86c1ae3fa6ebad47abb0991c958dd7a4bce12840280dfab013638909bc4656a2"
scope = "local"
groups = ["default"]
transport = "uvx"
package = "git+https://github.com/oraios/serena"
entrypoint = "serena"
args = ["start-mcp-server"]
tools = ["*"]
```

**Idea Input File**
https://github.com/Anselmoo/copilot-plugin-manager/blob/main/cpm.toml
Details

[package]
name = "copilot-plugin-manager"
version = "0.1.0"

[settings]
default_scope = "local"

[plugins]

[skills]

[agents]

[mcps]
serena = { rev = "946fdd558f7153c88cd648dd611f95ebb63951e5", type = "stdio", runner = "uvx", package = "git+https://github.com/oraios/serena", entrypoint = "serena", args = [
"start-mcp-server",
], tools = [
"*",
] }

[hooks]

[workflows]

[instructions]

### Example prompts or workflows

```
Commands:
init Initialise a new cpm project in the current directory
add Add an asset to cpm.toml and resolve it
sync Install everything recorded in cpm.lock
remove Remove an asset
promote Promote an asset from local → global scope
demote Demote an asset from global → local scope
update Update one or all assets to their latest versions
run Fetch and run an asset without installing it
overview Show a consolidated view of managed and installed assets
list List installed assets
show Show full details of a single asset
tree Show the dependency tree
doctor Verify all installed file hashes match the lockfile
status Show drift between manifest, lockfile, and disk
lock Resolve without installing (CI use)
reset Reset installed assets and/or manifest state
cache Manage the cpm cache
auth Manage authentication tokens
scope Get or set the default scope
help Print this message or the help of the given subcommand(s)

Options:
-v, --verbose Print additional strategy details for delegated vs native operations
-h, --help Print help
-V, --version Print version

Getting started:
init Create a new cpm.toml + cpm.lock in the current directory
add Add an asset to the manifest and resolve it
sync Install everything recorded in cpm.lock

Manage assets:
remove Remove a managed asset
promote Move an asset from local to global scope
demote Move an asset from global to local scope
update Update one or all assets
run Fetch and run an asset without installing it

Inspect & diagnose:
overview See the combined manifest, lockfile, and disk view
list List installed assets
show Show details for one asset
tree Show the dependency tree
doctor Verify installed file hashes
status Show manifest/lockfile/disk drift

Maintenance:
lock Resolve without installing
reset Remove managed state and installed assets
cache Inspect or clean the download cache
auth Manage authentication tokens
scope Get or set the default install scope
```

and also extend this for agent, skill, and hook installations based on the classical `copilot --help` interface

### Additional context

- That's my current approach: https://github.com/Anselmoo/copilot-plugin-manager for lock files and updating inspired by `uv`

- `bash -c "copilot plugin install`
- https://docs.github.com/en/copilot/how-tos/copilot-cli/customize-copilot/plugins-finding-installing#install-from-a-local-path

該 issue 未列出任何儲存庫檔案或測試；請從 `copilot plugin install` 背後的本機路徑流程開始，並將其與經典的 `copilot --help` 命令介面進行比較。定義外掛程式、代理程式、技能和掛鉤的清單、鎖定以及本機/全域範圍行為，然後驗證所列工作流程涵蓋穩定安裝和漂移偵測。

由索引模型根據 Issue 內容生成。