refactor: simplify plugin dependency handling

Simplify plugin installation and runtime loading around package-manager-owned dependencies, with Jiti reserved for local/TS fallback paths.

Also scans npm plugin install roots so hoisted transitive dependencies are covered by dependency denylist and node_modules symlink checks.

extensions/diffs/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "diffs",
   "activation": {
-    "onStartup": true
+    "onStartup": false
   },
   "name": "Diffs",
   "description": "Read-only diff viewer and file renderer for agents.",

extensions/diffs/package.json

@@ -17,11 +17,27 @@
     "@openclaw/plugin-sdk": "workspace:*"
   },
   "openclaw": {
-    "bundle": {
-      "stageRuntimeDependencies": true
-    },
     "extensions": [
       "./index.ts"
-    ]
+    ],
+    "install": {
+      "npmSpec": "@openclaw/diffs",
+      "localPath": "extensions/diffs",
+      "defaultChoice": "npm",
+      "minHostVersion": ">=2026.4.30"
+    },
+    "compat": {
+      "pluginApi": ">=2026.4.30"
+    },
+    "build": {
+      "openclawVersion": "2026.4.30"
+    },
+    "bundle": {
+      "includeInCore": false
+    },
+    "release": {
+      "publishToClawHub": true,
+      "publishToNpm": true
+    }
   }
 }

extensions/diffs/src/manifest.test.ts

@@ -3,20 +3,14 @@ import { describe, expect, it } from "vitest";
 
 type DiffsPackageManifest = {
   dependencies?: Record<string, string>;
-  openclaw?: {
-    bundle?: {
-      stageRuntimeDependencies?: boolean;
-    };
-  };
 };
 
 describe("diffs package manifest", () => {
-  it("opts into staging bundled runtime dependencies", () => {
+  it("keeps runtime dependencies in the package manifest", () => {
     const packageJson = JSON.parse(
       fs.readFileSync(new URL("../package.json", import.meta.url), "utf8"),
     ) as DiffsPackageManifest;
 
     expect(packageJson.dependencies?.["@pierre/diffs"]).toBeDefined();
-    expect(packageJson.openclaw?.bundle?.stageRuntimeDependencies).toBe(true);
   });
 });