Per-commit review follow-ups:
- Dot directories are scanned again, matching plugins_discovery. A
platform plugin that discovery loads from plugins/.x now also has
its secrets declared.
- Only PermissionError means a plugin directory cannot be searched. A
symlink loop is treated as missing, so plugin.yml is still checked,
as discovery does. A plugin.yaml that is not a regular file is
ignored rather than failing every strict read.
- Dropped a redundant union: the home set is already stripped in
Tier 1.
- Tests now pin the dunder skip, the unlistable platforms root, and a
stamp change on an edit that keeps the mtime.
9e26d34475