feat(kiosk): resolve constant plugin IDs, overrides and the CheckT helper

- kiosk.ReadIdentity: ID()/Requires() as literals or constants across packages and modules, read with go/parser, never run
- plugin minimums from go.mod requires; v0.0.0 is an error, a pseudo-version warns
- kiosk.Validate, kiosk.CheckT (no testing import)
- plugin:add reads IDs through kiosk.ReadIdentity, so const-ID plugins register

internal/build/build_test.go

@@ -1322,6 +1322,39 @@ func assertWinterPluginShape(t *testing.T, pluginDir string) {
 	}
 }
 
+// TestAddPluginConstID: plugin:add registers a plugin whose ID() returns a
+// package-level constant (research F1), and a literal-ID plugin as before.
+func TestAddPluginConstID(t *testing.T) {
+	dir := copyHelloApp(t)
+	ctx := t.Context()
+	plugins := map[string]string{
+		"consts": "package consts\n\nconst PluginID = \"acme.consts\"\n\ntype Plugin struct{}\n\nfunc (*Plugin) ID() string { return PluginID }\n\nfunc (*Plugin) Requires() []string { return nil }\n",
+		"lit":    "package lit\n\ntype Plugin struct{}\n\nfunc (*Plugin) ID() string { return \"acme.lit\" }\n\nfunc (*Plugin) Requires() []string { return nil }\n",
+	}
+	for _, name := range []string{"consts", "lit"} {
+		pluginDir := filepath.Join(dir, "plugins", "acme", name)
+		if err := os.MkdirAll(pluginDir, 0o755); err != nil {
+			t.Fatal(err)
+		}
+		write(t, filepath.Join(pluginDir, "go.mod"), "module example.test/acme/"+name+"\n\ngo 1.27.0\n")
+		write(t, filepath.Join(pluginDir, "plugin.go"), plugins[name])
+		if err := AddPlugin(ctx, dir, filepath.Join("plugins", "acme", name)); err != nil {
+			t.Fatalf("plugin:add %s: %v", name, err)
+		}
+	}
+	m, err := LoadManifest(filepath.Join(dir, "summer.yaml"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := map[string]string{}
+	for _, p := range m.Plugins {
+		got[p.ID] = p.Module
+	}
+	if got["acme.consts"] != "example.test/acme/consts" || got["acme.lit"] != "example.test/acme/lit" {
+		t.Fatalf("summer.yaml plugins = %+v", m.Plugins)
+	}
+}
+
 func copyHelloApp(t *testing.T) string {
 	t.Helper()
 	src, err := filepath.Abs(filepath.Join("..", "..", "examples", "hello"))