Idempotent syncPlugin -- the SPA-safe register

Calling register() N times against the same slug accumulates stale entries -- a known SPA remount footgun. v2.5 ships syncPlugin(slug, manifest) which REPLACES the manifest atomically, bumps V24-04 plugin_version for OCC, and fires nac:plugin:invalidated exactly once per replace. Calling syncPlugin twice with the same manifest leaves the registry exactly as the first call left it.