feat(kiosk): resolve constant plugin IDs, overrides and the CheckT helper

- kiosk.ReadIdentity: ID()/Requires() as literals or constants across packages and modules, read with go/parser, never run
- plugin minimums from go.mod requires; v0.0.0 is an error, a pseudo-version warns
- kiosk.Validate, kiosk.CheckT (no testing import)
- plugin:add reads IDs through kiosk.ReadIdentity, so const-ID plugins register

modules/kiosk/testdata/consts/nested/plugin.go

@@ -0,0 +1,14 @@
+// Package nested is a test fixture: a second plugin in a subdirectory of
+// the consts module, requiring the root plugin. It is never built.
+package nested
+
+import root "example.test/sm-consts-plugin"
+
+// Plugin is the fixture plugin.
+type Plugin struct{}
+
+// ID returns the plugin ID.
+func (*Plugin) ID() string { return "acme.constsnested" }
+
+// Requires the root plugin of the same module.
+func (*Plugin) Requires() []string { return []string{root.PluginID} }