fix: stop the plugin update guard firing on npm install artifacts

[ankitranjan7]

Found while checking a failing test on #266 — unrelated to that PR, so it's on its own branch.

Problem

plugin install runs npm install --omit=dev --ignore-scripts in the cloned checkout (src/plugin.ts). A plugin repo without a .gitignore then reports node_modules/ and package-lock.json as untracked, and the dirty-checkout guard refuses to update:

$ webcmd plugin install github:rishabhraj36/webcmd-plugin-bookmyshow
✅ Plugin "bookmyshow" installed successfully.
$ webcmd plugin update bookmyshow
Error: Plugin "bookmyshow" has uncommitted changes that updating would destroy:
  node_modules/ (new, unstaged)
  package-lock.json (new, unstaged)

The guard fires on webcmd's own output and blames the user for work they never did. Any such plugin is permanently un-updatable short of --force, which is documented as "discard uncommitted changes" — a scary flag for a clean checkout. getDirtyFiles' doc comment assumed git status would never surface node_modules because it is gitignored; that only holds when the plugin repo ships a .gitignore.

This is what fails tests/e2e/plugin-management.test.ts > plugin update succeeds on an installed plugin on main.

Change

• getDirtyFiles drops node_modules/ and package-lock.json at any depth — depth matters because monorepo installs run npm install at the repo root and in each sub-plugin.
• Porcelain path parsing extracted into dirtyEntryPath, shared with describeDirtyEntry.
• Everything else untracked is still real user work and still blocks the update. A file merely named like an artifact (node_modules_notes.md) still blocks; there's a test for that.

Not filtered: the .js files transpilePluginTs emits next to .ts sources. Those are indistinguishable from hand-written user files, and failing closed is the right default there.

Verification

npx vitest run → 405 files, 4854 passed, 1 skipped, 0 failed (the E2E now passes). npm run typecheck clean. Also verified by hand: install → update against the real bookmyshow plugin now succeeds.

🤖 Generated with Claude Code

[github-actions]

🟢 No documentation gap found — medium confidence

The automated review found no documentation gap in the supplied changes.

This review is advisory and does not block merging.