fix(plugins): 出站主机授权两处真缺陷 —— 已启动 worker 看不到新授权、授权不落盘

生产实证：channels 插件的 auth/state 在主机已授权后仍被拒
（auth/state 失败: host "copilot.tencent.com" is not an allowed outbound destination），
而 /api/plugins/channels/kernel 明明显示 hosts_granted=26。

缺陷一（授权对已启动 worker 无效）：
  httpAllowlist 是不可变快照；bootPluginState 在 worker 启动时把指针绑进 Lua
  闭包，闭包与 worker 同寿。GrantExtraHosts 之后 ps.allowHTTP 被**整个换新**
  （newHTTPAllowlist 返回新实例），已启动的 worker 仍持旧指针 → 授权接口返回
  ok、设置页显示已批，请求却继续被拒。分片 VM（plugin_shard.go）同样中招。
  修法：allowlist 改为带 RWMutex 的**可变共享对象**，GrantExtraHosts 与
  rebuildOutboundAllowlistLocked 原地 add —— 所有闭包立即看到新授权，worker
  无需重建。rebuild 从"替换实例"改为"原地折叠"，并在注释里写明为什么。

缺陷二（授权不持久化）：
  .kernel-perms.json 只写 actions；hosts 授权只存在运行态 map，重启即失。
  设置页看不出异常（actions 有持久化，读起来像"都持久化了"）。
  修法：文件行改为 jsonPluginPolicy{actions,all_read,hosts}（旧文件向后兼容，
  纯 actions 行照常解析）；Load 恢复 extraHosts；Save 把每个插件的 host 授权
  与 actions 一起写入（支持"只批了主机、没批动作"的行）。

回归测试（internal/lua/plugin_http_test.go）：
- TestGrantExtraHostsVisibleToAlreadyBootedWorker：按事故顺序构造（先启动
  worker → 再授权），断言同一批 worker 立即可用新授权 + 旧引用不再失效。
- TestHostGrantsPersistAcrossRestart：授权落盘 + 新 registry 读回 + 插件重载
  后授权保留。

go test ./internal/lua/ 全绿；build/vet 通过。

internal/lua/plugin_outbound.go

@@ -105,6 +105,18 @@ func normalizeHost(h string) string {
 // rebuildOutboundAllowlistLocked folds the SOURCE hosts and every GRANTED extra
 // host into the allowlist the HTTP bridge consults. Caller holds ps.mu.
 //
+// The allowlist object is mutated IN PLACE (allowHTTP.add) rather than replaced:
+// already-booted plugin workers hold the ORIGINAL pointer in their Lua closures
+// (bootPluginState captured it at boot), so replacing the field would strand
+// them on a stale copy — a grant would be recorded and displayed while requests
+// kept being refused. Mutating the shared object makes every closure see the
+// new hosts immediately.
+//
+// Note this FOLDS sources + grants additively: a host that loses its grant
+// cannot be un-allowed this way, which is acceptable because grants are
+// append-only operator approvals (revocation is a restart away — the persisted
+// file is the authority on boot).
+//
 // Declared-but-not-granted hosts are deliberately excluded: that exclusion is the
 // whole security property, so it is the one thing this function must not be
 // tempted to "helpfully" relax.
@@ -113,7 +125,7 @@ func (ps *Plugins) rebuildOutboundAllowlistLocked() {
 	for _, granted := range ps.extraHosts {
 		hosts = append(hosts, granted...)
 	}
-	ps.allowHTTP = newHTTPAllowlist(hosts)
+	ps.allowHTTP.add(hosts)
 }
 
 // readPluginExtraHosts reads `plugin.hosts`, the outbound hosts a plugin needs