Plugin admission state now enforced for cross-plugin calls and hook loading

What

• Cross-plugin calls (using the $.<name>.<method> syntax one plugin uses to call into another) now check whether the target plugin's environment has actually been admitted, and reject with a clear error if it hasn't — previously this only checked whether the plugin was loaded at all.
• The code that loads a plugin's hook modules was reworked from a single pass into a loop that admits or refuses each module. If a module that already ran its engine.create hook later turns out to be refused, the whole set of already-admitted modules is discarded and reloading is retried without it, with a log message noting this happened. The loop repeats until no plugin still needs to be recreated.

Why

These changes make sure a plugin can't act (call other plugins, or keep hooks registered) unless it has genuinely passed admission, closing a gap where a loaded-but-not-admitted plugin could previously be treated as usable.