[CF-DATAPLANE][CPEX] Publish effective tool-plugin bindings to the dataplane

[lucarlig]

Parent epic: #4525

Gap

The Control Plane stores ToolPluginBinding records and resolves them for its own execution path, but the dataplane publisher does not export those bindings. The Rust dataplane therefore cannot reproduce Control Plane-selected plugin execution.

Scope

• Build an effective, versioned plugin snapshot for each published principal/virtual host.
• Include stable tool/backend identifiers, ordered plugin bindings, mode, priority, plugin configuration, secret references, and on_error behavior.
• Publish snapshots atomically through the existing Redis contract.
• Trigger publishing when plugin definitions, tool bindings, visibility, or relevant configuration changes.
• Notify/invalidate dataplane caches so a new snapshot becomes active promptly.

Acceptance criteria

• The published snapshot deterministically represents the effective bindings for a tool call.
• Binding order and failure policy match Control Plane behavior.
• Secrets are referenced, not embedded as plaintext.
• Binding changes produce a new version and invalidate stale dataplane state.
• Empty or invalid binding state cannot accidentally enable a plugin.

Related work

• Generic push-publisher epic: [EPIC][CF-DATAPLANE] Incrementally move dataplane config publishing from pull to push #5577
• Tool binding model/API already exists in the Control Plane.