fix(host): keep Shibumi working under Omarchy 4.0.3 plugin facades

[stevenklar]

Omarchy 4.0.3 (omacom/omarchy#10733, backport of #9618) replaces the host objects injected into third-party plugins with capability-scoped facades: serviceFor resolves only the caller's own service, the registry view holds only the caller's manifest with no pluginsChanged, shell.bar is a scalar view, __sourceDir is stripped, and only bar plugins receive first-party proxies. Shibumi's bar rendered as an empty outline, the Control Center listed no plugins, and embedded widgets (tray, update badge) never loaded.

Changes

• hancore.shibumi.state/host/: a shared Registry singleton plus HostShell adapter. Every suite service registers itself and wraps its injected shell, so suite-internal lookups, the active bar item and first-party proxies resolve on both 4.0.2 and 4.0.3. A PluginCatalogue rebuilds the registry surface from manifest files and the host's listPlugins IPC, and routes enable/disable through the host's setPluginEnabled/enablePlugin IPC.
• Bar: adopt the catalogue when the host injects a scoped registry; resolve host widgets from barWidgetRegistry when no entry point is available and keep those handles once resolved; derive pluginSourceDir from the plugin's own location so payload verification keeps working.
• Status service: attach the notification proxy reactively, since the bar registers after the services.

Security boundary

This does not touch what #9618 protects: authentication services stay outside the public service map and the reachable object graph, and nothing here references them. The registry shares only Shibumi's own services and bar among Shibumi's own plugins. It does extend the bar's narrow non-authentication proxies (idle, media, notifications) to suite services, and the directory is importable by any sibling plugin. Upstream's documented alternative is reduced functionality under replacement bars.

Known limits

The notifications proxy carries only Do Not Disturb, so the bell has no history under 4.0.3. check-production-boundary flags the sibling import as a package escape, and smoke tests that copy single plugin directories will need hancore.shibumi.state/host alongside; both are left for follow-up.

Verified

On Omarchy 4.0.3-1 with an isolated Quickshell smoke against a scoped facade and on a live session: full bar, tray, bell, and the Control Center plugin list restored; health check clean.

[HANCORE-linux]

Thanks for the PR which helps me for some partial fixes but not for a full implementation.

[stevenklar]

@HANCORE-linux feel free to use it as a base for a complete fix. I don't mind.