docs: document marketplace plugins and clarify no-op hook execution

[onyekachi66]

Description:

Closes #1345

This PR updates the README.md to formally document the Marketplace Plugins system, clarifying its intended usage and current limitations.

Affected Modules:

• README.md

Proposed Changes / Acceptance Criteria Met:

• Manifest fields documented: The documentation accurately lists the requirements from pluginManifestSchema (e.g. id, name, version, hooks, etc.).
• Hooks no-op nature: We explicitly stated that the executeHook system is currently a stub and no code execution occurs.
• Endpoints & Auth: A complete list of lifecycle endpoints and their required authentication is now included in the README.
• Sandboxed flag clarified: Added an explanation that the sandboxed: true flag in the installation record is informative and indicates the future design intent (running in an isolated Worker/VM) rather than its current state.

Security and Failure-Mode Handling:

• The update is purely documentation-based. No changes to the runtime API have been made. Therefore, it does not alter any existing security boundaries, authentication paths, or error handling.
• It brings clarity to developers about what is and isn't executed securely on our platform at this moment, mitigating false expectations regarding business rule enforcement.

Testing Strategy:

• The changes are strictly cosmetic and documentation-related in README.md. No test regressions are expected.
• Reviewed against src/routes/marketplace/plugins.test.ts to ensure our descriptions align with the exact endpoints and behaviors outlined in the test suite and source code.

[drips-wave]

@onyekachi66 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits