docs(cli): os create plugin's standalone output is unscoped and private (#17547)

The #15530 ruling landed in PR #17096: the standalone default emission of
`os create plugin` names the package `plugin-<name>` — unscoped — and writes
`"private": true`. `--in-repo` is unchanged and still emits a publishable
`@objectstack/plugin-<name>` under `packages/plugins/`.

Three hand-written statements still promised the pre-ruling behaviour and sent
a reader to a `npm publish` that npm refuses:

- `content/docs/deployment/cli.mdx` scaffolder-routing table, "Publishable?"
- `content/docs/deployment/cli.mdx` `#### os create` intro prose ("publishable")
- `content/docs/plugins/index.mdx` "Which artifact this page means" callout

All three are re-derived from the generator (`packages/cli/src/commands/create.ts`
`pluginDirName` / `pluginPackageName` / the standalone `private: true`), not from
the ruling text.

The "Publishable?" column keeps discriminating between the two scaffolders: the
`os init -t plugin` cell is "No, and no flag lifts it"; the `os create plugin`
cell is "Only with --in-repo".

Claude-Session: https://claude.ai/code/session_01DapQyvYrFb1MxSYe7BL2nt

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-justin

content/docs/deployment/cli.mdx

@@ -102,8 +102,8 @@ Scaffolds a new ObjectStack project with configuration, TypeScript setup, and in
 
 | The word `plugin` in | Names | What it emits | Built by | Publishable? | Read next |
 |:---------------------|:------|:--------------|:---------|:-------------|:----------|
-| `os init <name> -t plugin` | A **metadata package** — declarative objects another stack loads, no kernel code | `objectstack.config.ts` whose manifest declares `type: 'plugin'`, plus `src/objects/*.object.ts` | `objectstack compile` (its `build` script) | **No** — the emitted `package.json` is `private: true` | [`os init`](#os-init) below, and [Object Metadata](/docs/data-modeling/objects) for the objects it holds |
-| `os create plugin <name>` | A **kernel code plugin** — TypeScript implementing the kernel `Plugin` contract | `src/index.ts` exporting a `Plugin` with `init` / `destroy` | `tsc` (its `build` script) | **Yes** — a publishable `@objectstack/plugin-<name>` package | [`os create`](#os-create) below, then [Plugin Anatomy](/docs/plugins/anatomy) and [Plugin Development](/docs/plugins/development) |
+| `os init <name> -t plugin` | A **metadata package** — declarative objects another stack loads, no kernel code | `objectstack.config.ts` whose manifest declares `type: 'plugin'`, plus `src/objects/*.object.ts` | `objectstack compile` (its `build` script) | **No** — the emitted `package.json` is `private: true`, and no flag lifts it | [`os init`](#os-init) below, and [Object Metadata](/docs/data-modeling/objects) for the objects it holds |
+| `os create plugin <name>` | A **kernel code plugin** — TypeScript implementing the kernel `Plugin` contract | `src/index.ts` exporting a `Plugin` with `init` / `destroy` | `tsc` (its `build` script) | **Only with `--in-repo`** — the default standalone emission is an unscoped `plugin-<name>` marked `private: true`; `--in-repo` emits a publishable `@objectstack/plugin-<name>` | [`os create`](#os-create) below, then [Plugin Anatomy](/docs/plugins/anatomy) and [Plugin Development](/docs/plugins/development) |
 
 Every page under [Plugins & Packages](/docs/plugins) teaches the **kernel code plugin**, so
 `os create plugin` is the scaffolder those pages mean — `os init -t plugin` will not give
@@ -1334,7 +1334,7 @@ third-party extension primitive, authored as `src/skills/<name>.skill.ts` with
 #### `os create`
 
 Scaffolds a **standalone** **kernel code** plugin project (the `Plugin` contract,
-built by `tsc`, publishable; *not* the **metadata package** `os init -t plugin` emits — see
+built by `tsc`; *not* the **metadata package** `os init -t plugin` emits — see
 [Which scaffolder?](#os-init)) into the current directory:
 
 ```bash
@@ -1363,6 +1363,14 @@ published semver ranges pinned to the version of the CLI that generated it, and
 the emitted `tsconfig.json` is self-contained, so the project installs and
 builds anywhere — a workspace around it is neither needed nor assumed.
 
+That manifest is named `plugin-<name>` — **unscoped** — and carries
+`"private": true`, because `@objectstack` is a scope the developer this command
+scaffolds for cannot publish to: an accidental `npm publish` is refused loudly
+instead of being aimed at a namespace you do not own. To publish it yourself,
+rename it under a scope you control and drop that flag. Only `--in-repo` below
+emits a scoped, publishable `@objectstack/plugin-<name>`, and it lands under
+`packages/plugins/` where every sibling genuinely carries that scope.
+
 **Options:**
 - `-d, --dir <directory>` — Write the project here instead of `./<name>`
 - `--in-repo` — Scaffold **inside an ObjectStack monorepo checkout** instead

content/docs/plugins/index.mdx

@@ -77,9 +77,11 @@ Plugins follow a strict three-phase lifecycle (`init()` → `start()` → `destr
 
 <Callout type="info">
 **Which artifact this page means.** Every plugin taught here is a **kernel code
-plugin** — TypeScript implementing the `Plugin` contract, built by `tsc`, published as
-`@objectstack/plugin-<name>`. That is what `os create plugin` scaffolds. If what you
-want instead is a **metadata package** — declarative objects another stack loads, with
+plugin** — TypeScript implementing the `Plugin` contract, built by `tsc`. That is
+what `os create plugin` scaffolds: by default an unscoped `plugin-<name>` package
+marked `"private": true`, or a publishable `@objectstack/plugin-<name>` under
+`--in-repo` inside a checkout of the ObjectStack monorepo. If what you want instead
+is a **metadata package** — declarative objects another stack loads, with
 no kernel code — the scaffolder is `os init <name> -t plugin`, and
 [Which scaffolder?](/docs/deployment/cli#os-init) routes between the two by artifact
 rather than by the word `plugin`, which the CLI spells the same for both.