chore: upgrade linters to v2, use os.OpenRoot for safe file access

[bojanrajkovic]

Summary

• Upgrade golangci-lint from 1.64.5 to 2.9.0 and gofumpt from 0.7.0 to 0.9.2
• Migrate .golangci.yml to v2 config format (formatters section, linters.exclusions.rules, gosimple merged into staticcheck)
• Replace all os.ReadFile calls with os.OpenRoot + fs.FS to eliminate gosec G304 warnings through defense-in-depth rather than nolint directives
• Add fs.FS-based public APIs (ReadPluginManifestFS, ScanPluginComponentsFS, ReadPluginConfigsFS) for testability and shared-root usage
• Add 14 new tests using fstest.MapFS for in-memory filesystem testing

🤖 Generated with Claude Code

[bojanrajkovic]

Test Plan

• mise run ci passes (fmt, vet, lint, test, build) — 0 lint issues, all 100+ tests pass
• golangci-lint config verify validates the v2 config schema
• New fstest.MapFS tests cover: manifest parsing (string/object author, missing, invalid JSON), component scanning (all types, mcp.json fallback, empty), config reading (single, multiple, none), settings reading (valid, missing)
• Existing getAllEnabledPlugins integration tests still pass through os.OpenRoot path
• ./cpm launches and displays plugin list correctly
• Plugin detail pane shows manifest info, components, README, and config viewer