feat(kiosk): resolve constant plugin IDs, overrides and the CheckT helper

- kiosk.ReadIdentity: ID()/Requires() as literals or constants across packages and modules, read with go/parser, never run
- plugin minimums from go.mod requires; v0.0.0 is an error, a pseudo-version warns
- kiosk.Validate, kiosk.CheckT (no testing import)
- plugin:add reads IDs through kiosk.ReadIdentity, so const-ID plugins register

modules/kiosk/check.go

@@ -16,6 +16,9 @@ func Generate(ctx context.Context, dir string, opts DeriveOptions) ([]byte, []st
 	if err != nil {
 		return nil, warnings, err
 	}
+	if err := Validate(m); err != nil {
+		return nil, warnings, err
+	}
 	out, err := Marshal(m)
 	if err != nil {
 		return nil, warnings, err
@@ -89,3 +92,21 @@ func Check(ctx context.Context, dir string) error {
 	}
 	return nil
 }
+
+// TB is the part of testing.TB that CheckT uses; *testing.T satisfies it.
+type TB interface {
+	Helper()
+	Fatalf(format string, args ...any)
+}
+
+// CheckT fails the test when dir's plugin.yaml is missing or stale. A
+// plugin repository calls it from one test, so go test catches a manifest
+// that no longer matches the code:
+//
+//	func TestPluginManifest(t *testing.T) { kiosk.CheckT(t, ".") }
+func CheckT(t TB, dir string) {
+	t.Helper()
+	if err := Check(context.Background(), dir); err != nil {
+		t.Fatalf("%v\nregenerate it with: summer plugin:manifest %s", err, dir)
+	}
+}