- Add host_acadrust_source and source-hash comparison helpers to ocs_plugin_api.
- Track acadrust_source and acadrust_declared in ExternalPlugin/ReleaseInfo.
- Apply repo-level policy: if any release in a repo declares acadrust_source, undeclared v4+ releases from that repo are incompatible.
- Preserve API v2/v3 backwards compatibility: legacy undeclared releases stay installable.
- Update Plugin Manager UI to only offer compatible releases and show 'acadrust mismatch' status.
- Drop acadrust_version from gate logic; only acadrust_source is required.