Managed prependPlugins/appendPlugins replace the old secDefault setting for hook ordering

What

• Two new managed-settings keys, prependPlugins and appendPlugins, let an organization list plugin ids (in the form plugin@marketplace) whose hooks must run first (outermost) or last (innermost) among the plugins in the hooks chain.
• The built-in sec-default hooks module (Claude Code's default security/policy protection hooks) now checks whether the org's prependPlugins list includes sec-default@builtin, and reports its seating reason as "seated by managed prependPlugins at position N" or "not seated: managed prependPlugins does not list it".
• The old secDefault managed-settings boolean, which used to just seat the bundled sec-default plugin outermost (and had a special warning when shadowed outside managed settings), is removed entirely - no references to it remain.

Why

This replaces a single yes/no switch for the built-in security hooks with a general-purpose ordering mechanism, letting organizations control exactly where any plugin's hooks sit in the chain (not just whether the default security hooks run first), while keeping the ability to opt out of or explicitly retain that default seating.