fix(shell): keep __sourceDir on third-party plugin manifests

publicPluginManifest() stripped __sourceDir from every non-first-party
manifest, but service and panel plugin instances receive only that
stripped manifest and no separate sourceDir (unlike barWidgets, which
get meta.sourceDir). That left third-party service/panel plugins with
no way to locate their own bundled scripts and assets: any plugin that
launches a bundled script resolves it against an empty base path and
fails silently (e.g. Omarchy-Spotify hangs on "Checking playback
support…", its keyring/credential scripts never run).

__sourceDir is the plugin's own install directory, not a privilege
signal — the plugin's code already runs from there. Keep withholding
the real privilege markers (__isFirstParty, __hostCapabilities) but
stop stripping __sourceDir. The plugin auth-boundary test suite still
passes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

shell/shell.qml

@@ -317,7 +317,13 @@ ShellRoot {
     if (!manifest) return null
     if (manifest.__isFirstParty) return manifest
     var copy = JSON.parse(JSON.stringify(manifest))
-    delete copy.__sourceDir
+    // __sourceDir is the plugin's own install directory, not a privilege
+    // signal: a third-party service/panel plugin needs it to locate its
+    // bundled scripts and assets (barWidgets already receive it via
+    // meta.sourceDir, but service/panel instances get only this manifest).
+    // Stripping it left those plugins with no way to find their own files,
+    // silently breaking every plugin that shells out to a bundled script.
+    // Only the true privilege markers below are withheld from third parties.
     delete copy.__isFirstParty
     delete copy.__hostCapabilities
     return copy