Bump plugin contract to 0.32.0 and register new plugin tables

Exports caller_is_role on the plugin authorization surface. Additive name, so a minor bump. Scoped personal tokens are always refused by it, matching require_role, which stops a plugin from accidentally letting a scoped token inherit role authority from its owner.

Registers the tables added by the endpoint lock and policy hold work (endpointlocks, policyactionholds) plus the endpoint health tables in the alembic template, so plugin migrations see them and the ownership guard does not report them as unclaimed.

tests/test_plugin_importguard.py

@@ -28,7 +28,10 @@ def _write_pkg_plugin(plugins_dir, name, marker='source'):
         'core_version': '>=0.1.0,<1.0.0', 'api_prefix': f'/api/{name}',
     }))
     (pdir / '__init__.py').write_text('')
-    (pdir / 'plugin.py').write_text('# plugin\n')
+    # write_bytes, not write_text: on Windows write_text translates \n to
+    # \r\n, which changes the bytes that get signed and hashed and makes the
+    # verified_source assertion below fail for a purely platform reason.
+    (pdir / 'plugin.py').write_bytes(b'# plugin\n')
     (pdir / 'models' / '__init__.py').write_text(f'MARKER = {marker!r}\n')
     return pdir
 
@@ -81,7 +84,7 @@ def test_verified_source_signed_ok_tampered_raises(guarded):
 
     assert guard.verified_source(name, 'plugin.py') == b'# plugin\n'
 
-    (pdir / 'plugin.py').write_text('# tampered\n')
+    (pdir / 'plugin.py').write_bytes(b'# tampered\n')
     with pytest.raises(PluginVerificationError):
         guard.verified_source(name, 'plugin.py')