fix(plugins): load active generation after upgrades (#111141)

* fix(plugins): load newest managed generation when a prior install lingers

An upgrade writes a plugin's new version into a distinct managed project
directory (an `__openclaw-generation__` dir) without removing the previous one.
The persisted install record keeps pointing at the older, still-present
directory, so `mergeRecoveredManagedNpmRecord` falls through to returning the
persisted record and the runtime imports the stale version even though the newer
generation is installed. `isUnavailableManagedNpmInstallRecord` only self-heals
when the persisted path is gone, so an upgrading install (both directories
present) is not covered — `plugins inspect <id> --runtime` reports the old
version and `install`/`update` appear to silently no-op.

- Recovery now selects the highest-version record per plugin id across the
  legacy flat dir and any generation dirs, instead of whichever project root
  sorts last (generation-dir suffixes are hashes, so on-disk order is unrelated
  to version).
- When the recovered managed install is a strictly newer version at a different
  path, repoint to it, reusing the metadata merge the unavailable-path branch
  uses. The repoint is gated to persisted records that live inside the managed
  npm root, so intentional custom/outside npm installs are left untouched.

This is a recovery-layer self-heal, so it also repairs installs that already
diverged from an earlier upgrade.

Refs #107228

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(plugins): honor active managed generations

Recover ambiguous managed installs by package recency only when no usable active ledger path exists, and let doctor retire non-authoritative generations safely.

Co-authored-by: Peter Lindsey <peter@lindsey.jp>

* test(plugins): use shared temp cleanup

* fix(plugins): compare active paths per platform

* fix(plugins): use managed install timestamps

* test(plugins): timestamp managed project roots

* test(plugins): exclude retired legacy recovery

* refactor(plugins): keep recovery candidate private

---------

Co-authored-by: Peter Lindsey <peter@lindsey.jp>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>

docs/cli/plugins.md

@@ -523,7 +523,7 @@ The local plugin registry is OpenClaw's persisted cold read model for installed
 
 Use `plugins registry` to inspect whether the persisted registry is present, current, or stale. Use `--refresh` to rebuild it from the persisted plugin index, config policy, and manifest/package metadata. This is a repair path, not a runtime activation path.
 
-`openclaw doctor --fix` also repairs registry-adjacent managed npm drift: if an orphaned or recovered `@openclaw/*` package under a managed plugin npm project or the legacy flat managed npm root shadows a bundled plugin, doctor removes that stale package and rebuilds the registry so startup validates against the bundled manifest. Doctor also relinks the host `openclaw` package into managed npm plugins that declare `peerDependencies.openclaw`, so package-local runtime imports such as `openclaw/plugin-sdk/*` resolve after updates or npm repairs.
+`openclaw doctor --fix` also repairs registry-adjacent managed npm drift. If an orphaned or recovered `@openclaw/*` package under a managed plugin npm project or the legacy flat managed npm root shadows a bundled plugin, doctor removes that stale package and rebuilds the registry so startup validates against the bundled manifest. When an authoritative install record selects one managed generation but older flat or generation directories remain, doctor retires those stale trees for pruning after the gateway restarts. Doctor also relinks the host `openclaw` package into managed npm plugins that declare `peerDependencies.openclaw`, so package-local runtime imports such as `openclaw/plugin-sdk/*` resolve after updates or npm repairs.
 
 ## Marketplace