Fix reviewed IPC, plugin lifecycle, and dev-shim findings

[MerhiOPS]

Summary

• harden IPC worker and runtime timeout handling so panics and queued requests do not leak capacity or strand workers
• align dev shims with production capabilities, including �olt:plugins, permission enforcement, SSRF guards, and consistent dev error formatting
• close the remaining plugin lifecycle, storage, deferred-queue, and grant-registry gaps from the review findings

Validation

• pnpm --filter @voltkit/volt-cli test -- src/tests/dev-backend.test.ts
• cargo test -p volt-runner process_task_releases_window_slot_when_dispatch_panics -- --nocapture
• cargo test -p volt-runner queued_ipc_requests_consume_the_same_end_to_end_timeout_budget -- --nocapture
• cargo test -p volt-runner panicking_lifecycle_subscribers_do_not_stop_other_handlers -- --nocapture
• cargo test -p volt-runner drain_waiters_disconnects_pending_receivers -- --nocapture
• cargo test -p volt-core test_revoke_grant_removes_plugin_delegations -- --nocapture
• cargo test -p volt-core revoke_grant_everywhere_prunes_empty_plugin_entries -- --nocapture
• cargo test -p volt-plugin-host send_request_rejects_when_deferred_queue_exceeds_limit -- --nocapture
• cargo test -p volt-runner deactivation_during_spawning_cancels_startup_and_terminates_plugin -- --nocapture
• cargo test -p volt-runner disabled_plugins_ignore_process_exit_transitions -- --nocapture
• cargo test -p volt-runner subscribe_and_off_recover_after_mutex_poisoning -- --nocapture
• cargo test -p volt-runner emit_recover_after_mutex_poisoning -- --nocapture

Commit layout

• c5d6e49 high-severity fixes