The runtime loader (hermes_cli/plugin_catalog.py) and the site feed
(website/scripts/extract-plugins.py) only ever see entries that passed the
structural validator, which now carries the subdir, whitespace-repo and
\Z-anchored sha rules. Every runtime subdir consumer (install, preview,
transaction) already goes through _resolve_subdir_within, which refuses an
escaping subdir. Mirroring the rules there duplicated the gate and changed
runtime behaviour for null and padded subdirs, so revert both files and
their test to main.
e780748afc