feat: add realistic sandbox plugin tests

[ascorbic]

What does this PR do?

Adds a realistic test host for sandboxed plugin authors, stacked on #3081.

• Publishes @emdash-cms/plugin-test, which builds the plugin and configures D1, Worker Loader, and PluginBridge through @cloudflare/vitest-plugin.
• Runs hooks and routes through EmDash's production Cloudflare sandbox runner, with helpers for content fixtures, plugin storage, and KV assertions.
• Updates emdash-plugin init so generated projects include the Vitest configuration, a real sandbox-host test, and the pnpm build-script policy required by workerd.
• Replaces the renamed @cloudflare/vitest-pool-workers dependency across the repository with @cloudflare/vitest-plugin 1.x.
• Documents the testing workflow and updates both the repository and generated plugin-authoring skills.

Discussion: #1590

Type of change

• Bug fix
• Feature (requires maintainer-approved Discussion)
• Refactor (no behavior change)
• Translation
• Documentation
• Performance improvement
• Tests
• Chore (dependencies, CI, tooling)

Checklist

• I have read CONTRIBUTING.md
• pnpm typecheck passes
• pnpm lint passes
• pnpm test passes (or targeted tests for my change)
• pnpm format has been run
• I have added/updated tests for my changes (if applicable)
• User-visible strings in the admin UI are wrapped for translation (not applicable: no admin UI strings). Do not include messages.po changes except in translation PRs — a workflow extracts catalogs on merge to main.
• I have added and reviewed the user-facing changeset (if this PR changes a published package)
• New features link to an approved Discussion: RFC: Attested Automated Publishing #1590
• I have included screenshots below if this PR changes the UI (not applicable: no UI change)

AI-generated code disclosure

• This PR includes AI-generated code — model/tool: OpenAI Codex (GPT-5)

Screenshots / test output

Not applicable: no UI change.

Verified locally:

• frozen install, root package build, typecheck, type-aware lint, formatting, and all package tests;
• 457 plugin CLI tests and 2 real Worker Loader plugin-host tests;
• clean generated pnpm project through install, validation, typecheck, build, and its generated sandbox test;
• docs reference inventory and production build;
• existing workerd/D1, aggregator, release verifier, EmDashBot, registry verification, and release-service suites using the renamed Cloudflare Vitest plugin;
• package publishing shape with publint, changeset status, and git diff --check.

[changeset-bot]

🦋 Changeset detected

Latest commit: d6420e6

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@emdash-cms/plugin-test	Minor
@emdash-cms/plugin-cli	Minor
@emdash-cms/perf-demo-site	Patch
@emdash-cms/cache-demo-site	Patch
@emdash-cms/do-demo-site	Patch
@emdash-cms/do-solo-demo-site	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://codex-plugin-test-host.try.emdashcms.com, https://codex-plugin-test-host-emdash-playground.emdash-cms.workers.dev (commit d6420e6)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://148c93d0.try.emdashcms.com, https://148c93d0-emdash-playground.emdash-cms.workers.dev	d6420e6	2026-09-12T11:41:00.918Z	Visit the dashboard ↗

[github-actions]

Scope check

This PR changes 994 lines across 47 files. Large PRs are harder to review and more likely to be closed without review.

If this scope is intentional, no action needed. A maintainer will review it. If not, please consider splitting this into smaller PRs.

See CONTRIBUTING.md for contribution guidelines.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	docs	d6420e6	Sep 12 2026, 11:40 AM

[github-actions]

Overlapping PRs

This PR modifies files that are also changed by other open PRs:

• ci: release #2983 (4 shared files)
• chore(deps-dev): bump the dev-dependencies group across 1 directory with 14 updates #2954 (4 shared files)
• feat: streamline plugin setup and delegated releases #3081 (8 shared files)

This may cause merge conflicts or duplicated work. A maintainer will coordinate.