docs: PLUGINS.md pins its `file:line` citations to a revision and every one is stale by 40 to 52 lines; its chapter-one input pattern silently swallows a secret reference

Observed behavior

docs/PLUGINS.md:16-17 says its references are taken against 5ab0309, "which changes nothing on this path." At eb8172f:

Reproduce with sed -n '314,316p' pkg/flowstate/v1/plugin/sdk/sdk.go. The page's whole evidentiary style is the citation, and it is the first thing a skeptical author checks. The generated references under docs/reference/ are drift-tested; the hand-written pages that cite lines are not.

Two more on the same page, found by following it literally (the walk itself works: nine commands, exit 0, about five minutes, no checkout needed):

• Chapter one's input pattern drops secrets. The snippet reads inputs["name"].GetLiteral().GetStringValue(), which returns "" for a Value_SecretRef, a Value_Expr, or an error value. Chapter two's setField (sdk/values.go:69-78) refuses all three with a sentence naming the fix. The IMPORTANT callout after chapter one warns about descriptors and validation only. A chapter-one plugin handed a secret reports name is required.
• The loaded plugin INFO line appears in no transcript. flow tasks, flow validate and flow run local print level=INFO msg="loaded plugin" on stderr (cmd/flow/plugins.go:759); flow plugins does not; no transcript in PLUGINS.md, EMBEDDING.md, or examples/plugins/greet/README.md shows it. A reader diffing against the doc sees a line the doc never shows, on three of four verbs.

Desired outcome

• Citations in hand-written docs are either symbol-based (sdk.Main, which gopls and a reader can find) or line-based and drift-tested: a test resolves every path:line in docs/*.md and asserts the line contains the symbol the sentence names, in the style of the generated-reference drift tests.
• Chapter one reads inputs through sdk.DecodeInputs or says in its callout that the raw-literal read is for literals only and what a secret does to it.
• Transcripts show stderr, or the INFO line moves to debug on the read-only verbs, and flow plugins and flow tasks agree.

Acceptance criteria

• The drift test fails on today's PLUGINS.md and passes after the citations are corrected.
• examples/plugins/greet compiled against the corrected chapter-one snippet still passes its test.

Constraints and dependencies

• Adjacent: #425 (documentation as one system), #1508 (plugin READMEs), #1541 (operator transcripts).

Start with docs/PLUGINS.md and reproduce the cited line mismatch using the provided sed command. Read the generated-reference drift tests, sdk.DecodeInputs, sdk/values.go, cmd/flow/plugins.go, and the named plugin transcripts. Done means corrected or drift-tested citations, safe chapter-one input guidance, and transcripts or logging that match the stated acceptance criteria.