Bump plugin contract to 0.32.0 and register new plugin tables

Exports caller_is_role on the plugin authorization surface. Additive name, so a minor bump. Scoped personal tokens are always refused by it, matching require_role, which stops a plugin from accidentally letting a scoped token inherit role authority from its owner.

Registers the tables added by the endpoint lock and policy hold work (endpointlocks, policyactionholds) plus the endpoint health tables in the alembic template, so plugin migrations see them and the ownership guard does not report them as unclaimed.

tests/test_core/test_security_headers.py

@@ -47,6 +47,7 @@ def test_a_served_upload_is_sandboxed(client, app, tmp_path, auth_headers):
     else:
         path.write_text(svg)
 
+    resp = None
     try:
         resp = client.get('/api/applications/image/probe-headers.svg', headers=auth_headers)
         assert resp.status_code == 200
@@ -54,4 +55,8 @@ def test_a_served_upload_is_sandboxed(client, app, tmp_path, auth_headers):
         assert resp.headers.get('X-Content-Type-Options') == 'nosniff'
     finally:
         import os
+        # The streamed file response keeps the handle open, and Windows refuses
+        # to delete a file that is still open. Release it before cleaning up.
+        if resp is not None:
+            resp.close()
         os.remove(path)