New diagnostics for org-managed hook restrictions on synced plugins

Two new plugin-issue diagnostics help explain org-managed hook behavior on synced plugins. managed-hooks-restricted reports when a plugin loads because it matches an org-mandated plugin by sync attribution, but its hooks are suppressed because allowManagedHooksOnly only runs hooks from the exact managed plugin@marketplace id. managed-plugin-disabled-by-settings reports when a locally-disabled copy of a plugin shadows what the org's managed settings expect to be running. Both include remediation text.