refactor: simplify plugin dependency handling

Simplify plugin installation and runtime loading around package-manager-owned dependencies, with Jiti reserved for local/TS fallback paths.

Also scans npm plugin install roots so hoisted transitive dependencies are covered by dependency denylist and node_modules symlink checks.

src/plugins/runtime/runtime-plugin-boundary.ts

@@ -1,10 +1,9 @@
 import fs from "node:fs";
 import path from "node:path";
 import { getRuntimeConfig } from "../../config/config.js";
-import { resolveBundledRuntimeDependencyJitiAliasMap } from "../bundled-runtime-deps-jiti-aliases.js";
 import { getCachedPluginJitiLoader, type PluginJitiLoaderCache } from "../jiti-loader-cache.js";
 import { loadPluginManifestRegistry } from "../manifest-registry.js";
-import { buildPluginLoaderAliasMap, shouldPreferNativeJiti } from "../sdk-alias.js";
+import { shouldPreferNativeJiti } from "../sdk-alias.js";
 
 type PluginRuntimeRecord = {
   origin?: string;
@@ -108,20 +107,11 @@ export function resolvePluginRuntimeModulePath(
 
 export function getPluginBoundaryJiti(modulePath: string, loaders: PluginJitiLoaderCache) {
   const tryNative = shouldPreferNativeJiti(modulePath);
-  const runtimeAliasMap = resolveBundledRuntimeDependencyJitiAliasMap();
   return getCachedPluginJitiLoader({
     cache: loaders,
     modulePath,
     importerUrl: import.meta.url,
     jitiFilename: import.meta.url,
-    ...(runtimeAliasMap
-      ? {
-          aliasMap: {
-            ...buildPluginLoaderAliasMap(modulePath, process.argv[1], import.meta.url),
-            ...runtimeAliasMap,
-          },
-        }
-      : {}),
     tryNative,
   });
 }

src/plugins/runtime/runtime-registry-loader.test.ts

@@ -162,7 +162,6 @@ describe("ensurePluginRegistryLoaded", () => {
         workspaceDir: "/resolved-workspace",
         onlyPluginIds: ["demo-channel"],
         throwOnLoadError: true,
-        installBundledRuntimeDeps: false,
       }),
     );
   });

src/plugins/runtime/runtime-registry-loader.ts

@@ -92,7 +92,6 @@ export function ensurePluginRegistryLoaded(options?: {
   workspaceDir?: string;
   onlyPluginIds?: string[];
   onlyChannelIds?: string[];
-  installBundledRuntimeDeps?: boolean;
 }): void {
   const scope = options?.scope ?? "all";
   const requestedPluginIdsFromOptions = normalizePluginIdScope(options?.onlyPluginIds);
@@ -175,7 +174,6 @@ export function ensurePluginRegistryLoaded(options?: {
     },
     {
       throwOnLoadError: true,
-      installBundledRuntimeDeps: options?.installBundledRuntimeDeps ?? false,
       ...(hasExplicitPluginIdScope(requestedPluginIds) ||
       shouldForwardChannelScope({ scope, scopedLoad }) ||
       hasNonEmptyPluginIdScope(expectedChannelPluginIds)