When the same plugin slug appears on more than one DOM root, every
root MUST carry a unique data-nac-plugin-id attribute.
The runtime enforces this in three layers: synchronous throw on
NAC.register, boot-time fatal banner via the
DOMContentLoaded validator, and a non-fatal
validate_global finding for CI pipelines. Migration
flag NAC.HARD_DEDUP=false opts out of the fatal pass
for one release window.