New CLAUDE_CODE_PLUGIN_DIRS environment variable for sideloading plugin directories

What

A new environment variable, CLAUDE_CODE_PLUGIN_DIRS, lets a session specify extra plugin folders (as a colon/path-list separated string) that get merged with any folders passed via --plugin-dir at startup.

• A new helper module parses, validates, dedupes, and can subtract these directories. Entries that are absolute paths outside the home directory, or use ~, are rejected with a warning rather than accepted, and there's a canned hint message for unsetting the variable.
• When set, CLAUDE_CODE_PLUGIN_DIRS is subject to the same enterprise sideload policy block as --plugin-dir and --plugin-dir-no-mcp, with its own recovery hint.
• Plugin sources of type pluginDirectory are now exempted from the usual blocklist check when a separate gate condition holds, before normal blocklist matching runs.

Why

This gives users and scripts a way to sideload plugin directories via environment configuration instead of only command-line flags, while keeping the same validation and enterprise policy controls that apply to --plugin-dir.