New CLI flags for the plugin-eval command: --trust-plugin and --allow-real-servers

The plugin evaluation command gains two new flags:

• --trust-plugin: skips the first-run trust prompt, meant for use in CI (continuous integration) pipelines, similar in spirit to --dangerously-skip-permissions
• --allow-real-servers: when combined with --mocks record, lets a plugin's real MCP server processes start and run for any servers that have no mock available, running outside Claude Code's OS sandbox (a restricted execution environment)

The --mocks help text was also expanded to better explain the difference between record and off behavior. Separately, when a plugin's MCP servers can't be enumerated (for example, an invalid manifest, archive, or MCPB bundle), setting allowRealServers now runs the real servers instead of refusing or mocking them; without it, an invalid manifest now causes affected cases to be refused outright in record mode, rather than just noted.