feat(plugin): wrap external-plugin calls in a panic guard

A buggy external plugin that panicked anywhere — during load (version,
register, manifest), during ribbon build / dispatch, or inside an
interactive command (prompt, on_point, on_enter, on_object_pick) — took
the host down with it (#134). Run every cdylib entry point under
catch_unwind so the host stays up: the plugin's call is treated as
inert (load fails, dispatch returns "didn't handle it", interactive
hooks resolve to Cancel) and a "Plugin <hook> panicked: …" line lands
in the command line on the next tick. (#145)

Scope is Rust panics across the cdylib boundary, not genuine UB —
real isolation (segfault-proof) still requires out-of-process plugins.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/app/update.rs

@@ -414,6 +414,14 @@ impl OpenCADStudio {
                     }
                 }
 
+                // Surface any plugin-guard panic messages that piled up since
+                // the last tick (the host singleton isn't reachable from inside
+                // the plugin hooks, so they queue and we flush here). (#145)
+                #[cfg(not(target_arch = "wasm32"))]
+                for msg in crate::plugin::drain_errors() {
+                    self.command_line.push_error(&msg);
+                }
+
                 Task::none()
             }