feat: add runtime plugin externals validation and native dep install

- validatePluginExternals() scans plugin dist/ for unbundled imports
  and warns when non-allowlisted externals are detected
- installPluginDepsIfNeeded() runs npm install for plugins with
  quartz.requiresInstall flag (for native deps like sharp)
- Added requiresInstall field to PluginManifest type

quartz/plugins/loader/index.ts

@@ -20,6 +20,7 @@ import {
   getPluginEntryPoint,
   toFileUrl,
   isLocalSource,
+  validatePluginExternals,
 } from "./gitLoader"
 
 const MINIMUM_QUARTZ_VERSION = "4.5.0"
@@ -191,6 +192,8 @@ async function resolveSinglePlugin(
       const module = await import(toFileUrl(entryPoint))
       const importedManifest: PluginManifest | null = module.manifest ?? null
 
+      validatePluginExternals(gitSpec.name, entryPoint, { verbose: options.verbose })
+
       manifest = importedManifest ?? {}
 
       const categoryOrCategories = manifest.category ?? detectPluginType(module)